41–50 of 180 posts
The intentional weakening of ECC has been an open secret for decades, and it's suspicious that this wasn't known by Juniper. I wonder if they were coerced into including it? https://www.schneier.com/blog/archives/2007/11/the_strange_s...
This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
The intentional weakening of ECC has been an open secret for decades, and it's suspicious that this wasn't known by Juniper. I wonder if they were coerced into including it? https://www.schneier.com/blog/archives/2007/11/the_strange_s...
What does "ECC" mean here?
Just wanted to acknowledge how brilliant that is. They could have made any other code change, but it was genius using NSA's own backdoor.
NSA advocated for that backdoor to be included in the standards. The US government then would be embarrassed and would want to cover up any issues related to it, including the fact that it was taken over by someone else!
Gotta wonder what that Monday morning meeting was like at the NSA when they realized what had happened.
This is ground breaking. The NSA made Juniper use a backdoored algorithm, and a foreign adversary hacked into Juniper and changed the backdoor key (essentially). That's surreal.
It's Bloomberg. Be skeptical.
Earlier quoted context omitted.
> The NSA made Juniper use a backdoored algorithm It's very important to clarify that the NSA didn't make them use it. The DoD required it as terms for future contracts. Juniper grabbed the money in knowing exchange for putting their customers at risk. Why does that distinction matter? It dramatically increases Juniper's culpability in the scheme. If the DoD had actually forced them to use it, that dramatically reduc…
Were Juniper informed of the vulnerability at the time they made the decision? It appears not.
I don't think America can ever recover from this breach of trust. Maybe NSA just needs to be shut down entirely. Or at least redefined explicitly as an adversarial agency to everyone.
The intentional weakening of ECC has been an open secret for decades, and it's suspicious that this wasn't known by Juniper. I wonder if they were coerced into including it? https://www.schneier.com/blog/archives/2007/11/the_strange_s...
When the NSA designed DEC, they primed it with constants, that you'd need to know to break the encryption with low effort.
Somebody discovered that and made it known publicly.
So now before the rumors evolve into actual security engineers looking into it, the NSA creates a scapegoat APT, that "altered" some "code" at Juniper.
Of course nobody finds out, who those APT are, because attribution is 1% more accurate than astrology.