backtop


Print 27 comment(s) - last by Perry Tanko.. on Jan 19 at 4:47 PM

NSA entered into a $10 million contract with RSA to place a flawed formula within encryption software

Security industry leader RSA was caught working with the U.S. National Security Agency (NSA), and now it's seeing some backlash from former allies. 
 
According to a new report from CNET, some leaders in the computer security world who were scheduled to speak at the RSA Conference next month have backed out due to recent discoveries about the RSA's connections with the NSA.
 
The report said Mikko Hypponen, chief technology officer of F-Secure; Josh Thomas, the Chief Breaking Officer at security firm Atredis, and Jeffrey Carr, another security industry veteran who analyzes espionage and cyber warfare methods, have all canceled their presentations at the RSA Conference.
 
Carr and Hypponen have taken it a step further by boycotting the conference. Hypponen said "nationality" was the reason for his cancellation while Carr said the RSA had violated its customers' trust. 
 
"I don't want to send mixed messages, so I have canceled all my appearances at RSA 2014," said Hypponen.
 
Once Carr announced his boycott, others followed, including Marcia Hoffman, privacy attorney and former Electronic Frontier Foundation lawyer; Alex Fowler, Mozilla privacy and public policy expert; Christopher Soghoian, American Civil Liberties Union advocate and privacy expert; Adam Langley, Google security expert, and Chris Palmer, Google Chrome security engineer. 
 
The RSA Conference is scheduled for next month in San Francisco.


Jeffrey Carr [SOURCE: jeffreycarr.blogspot.com]

According to documents leaked by former NSA contractor Edward Snowden, the NSA entered into a $10 million contract with RSA to place a flawed formula within encryption software (which is widely used in personal computers and other products) to obtain "back door" access to data. The RSA software that contained the flawed formula was called Bsafe, which was meant to increase security in computers. The formula was an algorithm called Dual Elliptic Curve, and it was created within the NSA. RSA started using it in 2004 even before the National Institutes of Standards and Technology (NIST) approved it. 
 
RSA said it had no idea that the algorithm was flawed, or that it gave the NSA back door access to countless computers and devices. The NSA reportedly sold the algorithm as an enhancement to security without letting the RSA in on its real intentions. 
 
"Recent press coverage has asserted that RSA entered into a 'secret contract' with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries.  We categorically deny this allegation," said RSA in a blog post.
 
Many in the security community were surprised at RSA's entanglement with the NSA, but the latest news of a $10 million contract as well has really shocked the industry.
 
RSA is known as a pioneer in the realm of computer security, and has notoriously fought off the NSA in previous attempts at breaking encryption in the 1990s. 
 
"I can't imagine a worse action, short of a company's CEO getting involved in child porn," said Carr. "I don't know what worse action a security company could take than to sell a product to a customer with a backdoor in it.”

Source: CNET



Comments     Threshold


This article is over a month old, voting and posting comments is disabled

RE: Real Believable
By JasonMick (blog) on 1/9/2014 7:07:27 PM , Rating: 5
Absolutely. RSA is just playing a silly semantics game.

The company's founders left long ago, and in its modern corporate-owned incarnation, it is badly hurting for cash. It claims it "worked with the NSA", writing:
quote:
Recent press coverage has asserted that RSA entered into a 'secret contract' with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries. We categorically deny this allegation.

We made the decision to use Dual EC DRBG as the default in BSafe toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption. At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption.
Note they never deny incorporating the flaw for cash. They simply deny KNOWINGLY incorporating it.

Google sec researcher Damien Miller writes:
quote:
RSA wins the prize for Carefully Worded Press Release of the year
Precisely... none of us are fooled.

You tried to save your crappy company by selling out corporate security and public privacy. Now your sh!t company is losing money. Don't make excuses for what you did. You dug the grave with your lies. Now it's your time to lie in it. Good riddance.


RE: Real Believable
By Spuke on 1/9/2014 10:13:22 PM , Rating: 4
quote:
Precisely... none of us are fooled.
Yep, and after their refusal to (at least initially) answer Congress' questions, I will no longer defend them (I defended them by saying they have masters that approved what they do, we need to go after those people...which is true but maybe gutting them will serve as a lesson to Congress and the White House). Quite frankly, the only thing I'm surprised at is the interception of electronics to implant tampering devices. Woah!

And what is the NSA thinking? With their refusal? We'll just let that slide now? Really? LOL!

The message is clear. You're under the big hairy eyeball now.


"So, I think the same thing of the music industry. They can't say that they're losing money, you know what I'm saying. They just probably don't have the same surplus that they had." -- Wu-Tang Clan founder RZA














botimage
Copyright 2014 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki