|
Title: The NSA's breach of RSA Inc's crypto: My answer - avoid American crypto Post by: Severian on October 09, 2013, 11:26:14 PM Quote We now know -- on balance of probabilities -- that the NSA conducted a 3 phased attack on the crypto world. First step was to insert a dodgy random number generator (RNG) into a NIST standard, called Dual_EC. Second step was to convince major suppliers to implement and set that RNG as the default. Third step is: Profit! which is to say, defeat your crypto. This step is effected by decrypting your traffic, knowing how the random numbers were fed into your protocol, and being able to predict them with some degree of crunchability. We have no information on that third step, but the information that has come out in the post-Snowden world is damning. We can conclude that this was a phased and deliberate approach. What then to do? As Jon Callas of Silent Circle puts it: Quote The problem one faces with the BULLRUN documents gives a decision tree. The first question is whether you think they're credible. If you don't think BULLRUN is credible, then there's an easy conclusion -- stay the course. If you think it is credible, then the next decision is whether you think that the NIST standards are flawed, either intentionally or unintentionally; in short, was BULLRUN *successful*. If you think they're flawed, it's easy; you move away from them. The hard decision is the one that comes next -- I can state it dramatically as "Do you stand with the NSA or not?" which is an obnoxious way to put it, as there are few of us who would say, "Yes, I stand with the NSA." You can phrase less dramatically it as standing with NIST, or even less dramatically as standing with "the standard." You can even state it as whether you believe BULLRUN was successful, or lots of other ways.Where do we stand? We need to answer a bunch of questions in order to get to a conclusion.... Article continued... (https://financialcryptography.com/mt/archives/001447.html) Title: Re: The NSA's breach of RSA Inc's crypto: My answer - avoid American crypto Post by: some1 on October 10, 2013, 02:54:00 AM Trust no one.
Blame on you, RSA & company! Really really interesting read... Thank you for sharing Severian |