• DOI:10.1007/S00283-015-9543-Z
• Corpus ID: 124392006

NSA and Dual EC_DRBG: Déjà Vu All Over Again?

@article{Landau2015NSAAD,
  title={NSA and Dual EC\_DRBG: D{\'e}j{\`a} Vu All Over Again?},
  author={Susan Landau},
  journal={The Mathematical Intelligencer},
  year={2015},
  volume={37},
  pages={72-83}
}

• S. Landau
• Published 21 October 2015
• Computer Science
• The Mathematical Intelligencer

F or months now, there has been vigorous debate about the National Security Agency’s (NSA) surveillance. Edward Snowden’s dramatic disclosures of classified documents touched it off, but some of the issues have been with us for years. What level of domestic and international surveillance should the U.S. government be conducting? All the reports and Congressional hearings have left things largely unsettled. One of the most striking of the Snowden revelations was that the NSA had subverted the effort of the National Institute of Standards and Technology (NIST) to set cryptographic guidelines for nongovernment users. Namely, NSA had arranged for NIST to endorse as being secure a cryptographic algorithm that in actuality could easily be broken. Now the NSA plays many roles in the mathematics community, including the funding of academic research, so its trustworthiness is a matter that strikes close to home. Some mathematicians have expressed great concern about the math community’s links with the U.S. Department of Defense. This article focuses on a single issue—the subversion of a widely used cryptographic algorithm, Dual EC_DRBG—and the consequences of this subversion. Why do I look at this one case as crucial? An increasing percentage of the world’s communications is electronic, and the only way to keep such communications confidential is throughcryptography. Subverting awidelyusedcryptographic algorithm disrupts the ability to protect communications against eavesdropping. Undermining NIST’s approval process for cryptographic algorithms badly damaged a process for cyber security that had gained domestic and international trust. It is not clear how the needed trust can be regained. The algorithm is the Dual Elliptic Curve Deterministic Random Bit Generator, mercifully abbreviated as Dual EC_DRBG. Its role is to generate pseudorandom bits. A cryptographic system may rely in principle on input of random bits. In practice, pseudorandom bits are used: bits that cannot be distinguished from random bits by any polynomial-time test. If the bits are predictable—and it turned out that the bits output by Dual EC_DRBG sometimes were predictable—then communications using the cryptographic system are not secure. Thus NSA’s subversion of Dual EC_DRBGprejudiced security very seriously. It foistedon the public a cryptography method that was backdoored—that is, it allowed easy decryption by an outside party, NSA, which possessed certain secret information. Documents leaked by Snowden in 2013 stated that NSA’s ‘‘SIGINT Enabling Project actively engages the U.S. and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs. These changes make the systems in question exploitable,’’ and the documents also stated that NSA resources ‘‘[i]nsert vulnerabilities into commercial encryption systems’’ and are used to ‘‘[i]nfluence policies, standards, and specifications for commercial public key technologies.’’ [48]. Understandably, many were outraged. The leaks strongly suggested that NSA had arranged for a cryptographic algorithm Dual EC_DRBG, into which the agency had placed a backdoor [23], to be a NIST-recommended algorithm for generating pseudorandom bits. This might appear to be a historic repeat of what occurred during the development of the 1970s Data Encryption Standard (DES), which was also believed to have a backdoor. A remark attributed to Mark Twain, ‘‘History does not repeat itself, but it does rhyme,’’ seems to be a more accurate description of the current situation. NSA’s DES effort both strengthened and weakened the algorithm; NSA’s Dual EC_DRBG maneuver is only negative, undermining the encryption systems relying on it [8].