Backdoor Concern Over US Crypto Standard

The possibility that there is a backdoor in one of the officially recommended random number generators (RNGs) used to create encryption keys, has caused two well-known encryption experts to declare the scheme to be useless.

In a Wired article this week, Bruce Schneier of BT Counterpane launched a stinging attack on the elliptic curve-based Dual_EC_DRBG, one of four techniques RNG designs approved by the U.S. National Institute of Standards and Technology (NIST) in March of this year.

Following on from a theoretical paper authored by Microsoft software engineers, Dan Shumow and Niels Ferguson, Schneier raises suspicions that the scheme has some kind of mathematically-significant backdoor put there by the U.S. National Security Agency (NSA), which in his view promoted its adoption by NIST.

The controversy surrounds numbers used to define the algorithm’s elliptic curve from which RNGs are created, which appear to be derived from a second set of hidden numbers. This is the so-called ’backdoor’.

“Of course, we have no way of knowing whether the NSA knows the secret numbers that break Dual_EC-DRBG. We have no way of knowing whether an NSA employee working on his own came up with the constants – and has the secret numbers. We don’t know if someone from NIST, or someone in the ANSI working group, has them. Maybe nobody does,” says Schneier.

“We don’t know where the constants came from in the first place. We only know that whoever came up with them could have the key to this backdoor. And we know there’s no way for NIST – or anyone else – to prove otherwise. This is scary stuff indeed.”

Phil Zimmermann, creator of PGP and Zfone, who himself famously clashed with the NSA in the early 1990s over an encryption backdoor called the Clipper Chip, was clear that the RNG in question should not be used by anyone for the time being.

“You are always having to worry about backdoors,” he said. “There is something there that doesn’t look quite right. We should not use that random number generator,” he agreed.

While the NSA is capable of introducing a backdoor, Zimmermann was unsure about its motivation for such an action.

“It is actually very risky to put in a backdoor because somebody is going to find out,” he said.

Anyone worried about the RNG should just ignore it and use one of the three others recommended by NIST, or abandon RNGs altogether in favour of alternatives such as block ciphers.

“I tend not to favor random number generators because they consume too many processor cycles,” said Zimmermann.

By John E. Dunn, Techworld.com