IT Jobs
Backdoor concern over US crypto standard
One of four NIST random number generators trashed.
By John E. Dunn, Techworld | Techworld
Published: 15:35 GMT, 16 November 07
The possibility that there is a backdoor in one of the officially recommended random number generators (RNGs) used to create encryption keys, has caused two well-known encryption experts to declare the scheme to be useless.
In a Wired article this week, Bruce Schneier of BT Counterpane launched a stinging attack on the elliptic curve-based Dual_EC_DRBG, one of four techniques RNG designs approved by the US National Institute of Standards and Technology (NIST) in March of this year.
Following on from a theoretical paper authored by Microsoft software engineers, Dan Shumow and Niels Ferguson, Schneier raises suspicions that the scheme has some kind of mathematically-significant backdoor put there by the US National Security Agency (NSA), which in his view promoted its adoption by NIST.
The controversy surrounds numbers used to define the algorithm's elliptic curve from which RNGs are created, which appear to be derived from a second set of hidden numbers. This is the so-called 'backdoor.'
"Of course, we have no way of knowing whether the NSA knows the secret numbers that break Dual_EC-DRBG. We have no way of knowing whether an NSA employee working on his own came up with the constants - and has the secret numbers. We don't know if someone from NIST, or someone in the ANSI working group, has them. Maybe nobody does," says Schneier.
"We don't know where the constants came from in the first place. We only know that whoever came up with them could have the key to this backdoor. And we know there's no way for NIST - or anyone else - to prove otherwise. This is scary stuff indeed."
Phil Zimmermann, creator of PGP and Zfone, who himself famously clashed with the NSA in the early 1990s over an encryption backdoor called the Clipper Chip, was clear that the RNG in question should not be used by anyone for the time being.
"You are always having to worry about backdoors," he said. "There is something there that doesn't look quite right. We should not use that random number generator," he agreed.
While the NSA is capable of introducing a backdoor, Zimmermann was unsure about its motivation for such an action.
"It is actually very risky to put in a backdoor because somebody is going to find out," he said.
Anyone worried about the RNG should just ignore it and use one of the three others recommended by NIST, or abandon RNGs altogether in favour of alternatives such as block ciphers.
"I tend not to favour number-theoretic random number generators because they consume too many processor cycles," said Zimmermann.
.gif)
Add your commentComments
John E. Dunn | Published: 09:16 GMT, 23 November 2007
Amendment made.
Philip Zimmermann | Published: 17:53 GMT, 22 November 2007
There is a misquote here, "I tend not to favour random number generators because they consume too many processor cycles." I never said all RNGs are too slow, only the RNGs in that class, which are based on number theory algorithms such as public key algorithms or elliptic curves. In fact, I recommended people use the other RNGs from the same NIST document. I use one of them myself.