RSA's 'Denial' Concerning $10 Million From The NSA To Promote Broken Crypto Not Really A Denial At All

from the between-the-lines... dept

On Friday, a very big story broke on Reuters, saying that the NSA had paid RSA $10 million in order to promote Dual EC DRBG encryption as the default in its BSAFE product. It had been suspected for a few years, and more or less confirmed earlier this year, that the NSA had effectively taken over the standards process for this standard, allowing it to hide a weakness, making it significantly easier for the NSA to crack any encrypted content using it.

As plenty of people noted, the news that RSA took $10 million to promote a compromised crypto standard pretty much destroys RSA’s credibility. The company, now owned by EMC, has now put out a statement in response to all of this, which some claim is the RSA denying the story. In fact, RSA itself states: “we categorically deny this allegation.” But, as you read the details, that doesn’t appear to be the case at all. They more or less say that they don’t reveal details of contracts, so won’t confirm or deny any particular contract, and that while they did promote Dual EC DRBG, and knew that the NSA was involved, they never knew that it was compromised.

In short: yes, RSA did exactly what the Reuters article claimed, but its best defense is that it didn’t know that Dual EC DRBG was compromised, so they didn’t take money to weaken crypto… on purpose. Even if that’s what happened.

We made the decision to use Dual EC DRBG as the default in BSAFE toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption. At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption.

Right, but that raises questions of why RSA trusted NSA to be a good player here, rather than trying to insert compromises or backdoors into key standards.

This algorithm is only one of multiple choices available within BSAFE toolkits, and users have always been free to choose whichever one best suits their needs.

Yes, but it was the default. And, as everyone knows, a very large percentage of folks just use the default.

We continued using the algorithm as an option within BSAFE toolkits as it gained acceptance as a NIST standard and because of its value in FIPS compliance. When concern surfaced around the algorithm in 2007, we continued to rely upon NIST as the arbiter of that discussion.

Again, this doesn’t make RSA look good. As has now become clear, the NSA had basically sneakily taken over the whole standardization process. RSA more or less trusting NIST without looking into the matter themselves raises questions. Especially if there was a $10 million contract that incentivized them not to dig too deeply. RSA promoted this standard as the default in BSAFE. You would hope that a company with the stature in the space like RSA would be more careful than just to rely on someone else’s say so that a particular standard is secure.

RSA claiming it didn’t know the standard the NSA paid them $10 million to make default was suspect is hardly convincing. Why else would the NSA suddenly pay them $10 million to promote that standard? Furthermore, it appears that news of this $10 million contract was known a bit more widely. Chris Soghoian points to an email from cypherpunk Lucky Green, from back in September, to a cryptography mailing list in which he more or less reveals the same info that Reuters reported on Friday, though without naming the company.

According to published reports that I saw, NSA/DoD pays $250M (per year?) to backdoor cryptographic implementations. I have knowledge of only one such effort. That effort involved DoD/NSA paying $10M to a leading cryptographic library provider to both implement and set as the default the obviously backdoored Dual_EC_DRBG as the default RNG.

This was $10M wasted. While this vendor may have had a dominating position in the market place before certain patents expired, by the time DoD/NSA paid the $10M, few customers used that vendor’s cryptographic libraries.

While this describes the right amount, if the NSA is really spending $250 million, it’s certainly possible that it has quite a few other $10 million contracts out there to promote or avoid certain other encryption standards depending on what it desires. Hopefully, some reporters are currently reaching out to all the companies on this list to see if they’ve got any contracts with the NSA concerning Dual EC DRBG.

Companies taking money from NSA, but claiming that they didn’t realize the encryption the contract pushed them to promote was compromised, aren’t going to find a very sympathetic audience outside of the NSA. The RSA’s “categorical denial” here misses the point. It certainly doesn’t suggest that the Reuters story was wrong — just that the RSA was so blinded by a mere $10 million that it didn’t bother to make sure the standard wasn’t compromised.

Filed Under: , , , , , ,
Companies: rsa

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “RSA's 'Denial' Concerning $10 Million From The NSA To Promote Broken Crypto Not Really A Denial At All”

Subscribe: RSS Leave a comment
out_of_the_blue says:

Google is far more effectively PAID OFF by not being TAXED.

Google has more than FIFTY BILLION offshore, untaxed — and won’t be nagged for it in current climate with Schmidt a pal of Obama. That’s orders of magnitude more than this payoff, so it’s a good bet that Google is far more compromised.

This is interesting reading:

“The ease and cost of surveillance are at an all-time low, Soghoian said, with Google charging an administrative fee of $25 to hand over data, Yahoo charging $20, and Microsoft and Facebook providing data for free.” — Yup, kids, mega-corps are selling you out for $25 bucks, TOPS.

Google’s tailoring to YOU can selectively substitute, omit, and lie. You can’t trust anything on the net, neither what you see nor what you don’t see!


Reality Check (profile) says:

Re: Google is far more effectively PAID OFF by not being TAXED.

Most of the time your angry incomprehensible mumblings at least have a small connection to the original post. This time, you failed to attempt any connection.

I’d say this is nothing but gibberated spam.

Get your own blog, instead of spending all your time spamming others.

That One Guy (profile) says:

And this helps them how?

Maybe I’m missing something, maybe large payoffs to promote a particular piece of software/standard are commonplace for companies like that, but it seems that if you’re in the position of deciding what encryption/security to promote, someone coming up and offering you millions to promote a particular one would at least trigger enough warning bells to investigate just why they were so interesting in having that standard/software get adopted.

Anonymous Coward says:

NSA has also infiltrated parts of IETF [1] and the Trusted Computing Group [2] (you know, the same “trusted computing” that Microsoft keeps promoting with Windows 8).

The NSA employees need to be kicked out of these groups unless they want everyone to lose trust in them, and some have already asked them to do so:

[1] –

[2] –

Fortunately, no one trusts NIST anymore, so at least we solved part of them problem. IETF will need to come up with its own security standards, and since Dan Bernstein’s algorithms and protocols are rapidly becoming popular (in TLS 1.3, Chrome, OpenBSD, TextSecure, DarkMail, OpenSSH, etc) as alternatives to NIST ones, they should name him a chair at IETF to provide the vision for a secure by default Internet, that’s protected with strong encryption.

Anonymous Coward says:

Lies, and more lies.

“At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption.”

Trusted by whom? Aren’t they in security business and supposed to see everything around as suspicious unless proven safe?

Suits should follow. For fraud, and retitution of gains. Better, before European courts.

“This algorithm is only one of multiple choices available within BSAFE toolkits, and users have always been free to choose whichever one best suits their needs.”

For this very lie, shey should go banktupt.

Justin B (profile) says:

Our Response

If it was a foreign entity pushing this weak encryption, we would immediately respond and replace all of it as well as ban that country/company from operating in the US. But we forget that by weakening encryption itself, our businesses/people are just as vulnerable to outside attack as they are to domestic ones from the NSA. Therefore, the damage is equal but our lack of courage to address the issue will keep everyone a vulnerable target, including us.

JackOfShadows (profile) says:

Which throat?

Which throat should be choke over this? Are any of those people still around? And if they’ve moved on, with suitably stuffed pockets, how can we reach out and touch them? While treated as people, sometimes (hell, often!) Corporations have significant bouts with amnesia, especially after a buyout.

Thankfully never worked at such a place, ‘less the US Navy counts.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...