Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Extended Random a Malicious NSA Plot?

sockpuppet.org

Post reply on HN
Print view View original

11–20 of 56 posts

Re: Is Extended Random a Malicious NSA Plot?

#11

Post by kordless »

jgon wrote: post #8

Doesn't this essay absolutely bury one of the most important parts of this scandal, that RSA used DUAL_EC as the default random number generator in their FIPS certified encryption product for almost a decade!?! I note that this is glossed over with a description so marginal I would tempted to call it dishonest if I were not trying to apply the principle of charity to its author. "RSA BSAFE had support for DUAL_EC." S…

> I will still not say that reasonable people can't disagree over the question at hand but the arguments presented in this article don't strike me as being anywhere near strong enough to make this the sort of grey area the author would like.

You have three negations in this sentence, which means it's nearly impossible to parse or understand. It's been my observation statements like these follow rationalizations about a point in which there exists dissonance. Given you seem to be disagreeing with something Thomas said or the way he said it, but not actually disagreeing with a point he made, I'd say that is the case here as well.

Violations of our privacy via rationalizations of security makes me sad and bored. I think we can all agree that things could be better with the situation, and I for one appreciate Thomas' efforts in bringing the truth to light.

Re: Is Extended Random a Malicious NSA Plot?

#13

Post by mod »

kordless wrote: post #11
jgon wrote: post #8

Doesn't this essay absolutely bury one of the most important parts of this scandal, that RSA used DUAL_EC as the default random number generator in their FIPS certified encryption product for almost a decade!?! I note that this is glossed over with a description so marginal I would tempted to call it dishonest if I were not trying to apply the principle of charity to its author. "RSA BSAFE had support for DUAL_EC." S…

> I will still not say that reasonable people can't disagree over the question at hand but the arguments presented in this article don't strike me as being anywhere near strong enough to make this the sort of grey area the author would like. You have three negations in this sentence, which means it's nearly impossible to parse or understand. It's been my observation statements like these follow rationalizations about…

> I will still not say that reasonable people can't disagree over the question at hand but the arguments presented in this article don't strike me as being anywhere near strong enough to make this the sort of grey area the author would like.

I didn't think it was that hard to read. It made sense on my first read, but here's my translation:

"I can see how arguments exist on both sides, but I don't think the author supported his argument with enough evidence to make it very relevant."

Re: Is Extended Random a Malicious NSA Plot?

#14

Post by detaro »

jgon wrote: post #8

Doesn't this essay absolutely bury one of the most important parts of this scandal, that RSA used DUAL_EC as the default random number generator in their FIPS certified encryption product for almost a decade!?! I note that this is glossed over with a description so marginal I would tempted to call it dishonest if I were not trying to apply the principle of charity to its author. "RSA BSAFE had support for DUAL_EC." S…

> "RSA BSAFE had support for DUAL_EC."

That line you quote isn't in the article. The only reference to DUAL_EC and BSAFE is in the timeline and says:

> Early 2004: RSA allegedly accepts payment to make Dual_EC the default in BSAFE, their crypto library.

Re: Is Extended Random a Malicious NSA Plot?

#15

Post by tedunangst »

Raj123123 wrote: post #12

PKRNG - if the attacker obtains the private key, why do they need the 28+bytes?

The attacker doesn't have the TLS private key, they have the RNG key. But they don't have the RNG seed. Recovering the seed is necessary to predict other RNG outputs and break TLS, but requires observing more RNG output than one typically sees.

Re: Is Extended Random a Malicious NSA Plot?

#16

Post by tedunangst »

detaro wrote: post #14
jgon wrote: post #8

Doesn't this essay absolutely bury one of the most important parts of this scandal, that RSA used DUAL_EC as the default random number generator in their FIPS certified encryption product for almost a decade!?! I note that this is glossed over with a description so marginal I would tempted to call it dishonest if I were not trying to apply the principle of charity to its author. "RSA BSAFE had support for DUAL_EC." S…

> "RSA BSAFE had support for DUAL_EC." That line you quote isn't in the article. The only reference to DUAL_EC and BSAFE is in the timeline and says: > Early 2004: RSA allegedly accepts payment to make Dual_EC the default in BSAFE, their crypto library.

jgon apparently took linkregister's advice to change "extended random" to dual_ec too literally, and changed a direct quote as well.

Re: Is Extended Random a Malicious NSA Plot?

#17

Post by chmike »

Raj123123 wrote: post #12

PKRNG - if the attacker obtains the private key, why do they need the 28+bytes?

Indeed. So the issue here is to deduce the symetric keys generated with a Cryptographically Secure Psoeudo Random Function (CSPRF) seeded with information exchanged during the initiating handshake and using the respective public and prvate keys, without having any private keys.

Imagine now that with a handfull pseudo random bytes sent in clear with the TLS protcol an eavesdropper could deduce the internal state of the CSPRF and thus the symmetric keys. They could decrypt the channel.

Re: Is Extended Random a Malicious NSA Plot?

#18

Post by mwcampbell »

cmg wrote: post #3
kens wrote: post #2

I hate to ask a dumb question, but the article discusses the actions of Clyde Frog a lot. Is Clyde Frog a person, a company, a government project, or what? A web search found a TV show and a stuffed animal, so I'm honestly puzzled. Edit: thanks cmg. I was reading the article on my phone and the side notes were off screen so I totally missed the explanation.

In small (11px), light-ish (#777777) next to the first paragraph: > If I call NSA “Clyde Frog” long enough, eventually other people will too. Someone has to start the meme! I think Dual_EC is a backdoor.

First time I've ever seen sidenotes done like that.

BTW, screen reader users (i.e. blind people) can't possibly miss the sidenotes; in fact, each sidenote will interrupt the text at the point where the note is most relevant. So a screen reader will render the first sentence like this:

Did Clyde Frog If I call NSA “Clyde Frog” long enough, eventually other people will too. Someone has to start the meme! subvert crypto standards with a backdoored random number generator called Dual_EC?

A little jarring when first encountered. (In my case, because I have some usable vision, I could tell what was going on.) I'd suggest sticking with more conventional footnotes, but I can see why this form of sidenote was appealing.

Re: Is Extended Random a Malicious NSA Plot?

#19

Post by ackalker »

It may be my (somewhat archaic) sense of crypto humor, but any time I read the term "Dual EC", my mind says "CE lauD", making it sound like someone saying the word "cloud" with an accent expressing a lot of disdain[1].

Anyway, the Dual EC backdoor, if real, along with the extra randomness, may yet prove to be part of "the gubment's" very own cloudbusting operation, to make cloud services rain users' secrets at the push of a button...

[1]: cf. "my butt"

Re: Is Extended Random a Malicious NSA Plot?

#20

Post by euroclydon »

Except for Hoffman’s last proposal, the extensions are cordoned off to the US Government. The sponsors of the standards and their authors make very little effort to provide a use case for normal Internet users.

If this were an X-Files episode, then the group who really runs the world would be forcing the USG to subvert it's own crypto.

Post reply on HN