Cyber Security Experts Boycott, Refuse to Speak at RSA Conference After NSA Deal
January 9, 2014 4:17 PM
comment(s) - last by
NSA entered into a $10 million contract with RSA to place a flawed formula within encryption software
Security industry leader
RSA was caught working with the U.S. National Security Agency
(NSA), and now it's seeing some backlash from former allies.
According to a new report from
, some leaders in the computer security world who were scheduled to speak at the RSA Conference next month have backed out due to recent discoveries about the RSA's connections with the NSA.
The report said Mikko Hypponen, chief technology officer of F-Secure; Josh Thomas, the Chief Breaking Officer at security firm Atredis, and Jeffrey Carr, another security industry veteran who analyzes espionage and cyber warfare methods, have all canceled their presentations at the RSA Conference.
Carr and Hypponen have taken it a step further by boycotting the conference. Hypponen said "nationality" was the reason for his cancellation while Carr said the RSA had violated its customers' trust.
"I don't want to send mixed messages, so I have canceled all my appearances at RSA 2014," said Hypponen.
Once Carr announced his boycott, others followed, including Marcia Hoffman, privacy attorney and former Electronic Frontier Foundation lawyer; Alex Fowler, Mozilla privacy and public policy expert; Christopher Soghoian, American Civil Liberties Union advocate and privacy expert; Adam Langley, Google security expert, and Chris Palmer, Google Chrome security engineer.
The RSA Conference is scheduled for next month in San Francisco.
Jeffrey Carr [SOURCE: jeffreycarr.blogspot.com]
According to documents leaked by former NSA contractor Edward Snowden, the NSA entered into
a $10 million contract with RSA
to place a flawed formula within encryption software (which is widely used in personal computers and other products) to obtain "back door" access to data. The RSA software that contained the flawed formula was called Bsafe, which was meant to increase security in computers. The formula was an algorithm called Dual Elliptic Curve, and it was created within the NSA. RSA started using it in 2004 even before the National Institutes of Standards and Technology (NIST) approved it.
RSA said it had no idea that the algorithm was flawed, or that it gave the NSA back door access to countless computers and devices. The NSA reportedly sold the algorithm as an enhancement to security without letting the RSA in on its real intentions.
"Recent press coverage has asserted that RSA entered into a 'secret contract' with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries. We categorically deny this allegation," said RSA in a
Many in the security community were surprised at RSA's entanglement with the NSA, but the latest news of a $10 million contract as well has really shocked the industry.
RSA is known as a pioneer in the realm of computer security, and has notoriously fought off the NSA in previous attempts at breaking encryption in the 1990s.
"I can't imagine a worse action, short of a company's CEO getting involved in child porn," said Carr. "I don't know what worse action a security company could take than to sell a product to a customer with a backdoor in it.”
This article is over a month old, voting and posting comments is disabled
RE: Real Believable
1/10/2014 11:58:59 AM
The problem here is not that they didn't check, it's that no one outside of the NSA thought that the algorithm using dual elliptic curves was breakable with current technology. Cryptography based on dual elliptic curve pseudo-random number generation has been around for a while, and was widely considered to be secure. I find it more surprising that the NSA was the only organization that found a way to break it; I expect that others (the Chinese, Russians, maybe some black hat hackers at the least) cracked it as well, but haven't been caught yet.
RE: Real Believable
1/10/2014 5:38:25 PM
They didn't break it so much as the version they provided was broken, extremely subtly. So subtle in fact that it's still an open debate if this back door even actually exists (personally I believe it does, for whatever that is worth).
The algorithm uses a few random numbers for the seed, even if you know what the numbers are you can't break anyone's use of it; that would have been detected and flagged immediately. No, what the NSA did was provide some numbers for the seed that had a very special relationship with one another. Knowing the numbers, and the relationship, they can look at the last few random numbers out of the algorithm and guess the next one.
Did RSA know that such a thing was possible? At the time it was pure conjecture that such an attack was possible. It's since been shown to be practical by white hat researchers. You also need to keep in mind that one of the NSA's charters is to provide and strengthen publicly available cryptography. Offering their expertise to RSA was entirely appropriate and expected. That doesn't, IMO, wash away RSA's responsibility to do due diligence, which they failed to do when they didn't demand the details of how the "random" seed values were generated (or better yet, generate their own).
"I mean, if you wanna break down someone's door, why don't you start with AT&T, for God sakes? They make your amazing phone unusable as a phone!" -- Jon Stewart on Apple and the iPhone
RSA Responds to Claim that it Gave NSA Back Door Access in Exchange for $10M
December 23, 2013, 11:43 AM
Rockstar Games' Parent Sues BBC Over Unauthorized "Grand Theft Auto" Drama
May 21, 2015, 6:05 PM
Oculus Rift Confirms "Pause" in OS X, Linux Development, Some Devs are Mad
May 18, 2015, 11:36 PM
Quick Note: Microsoft Windows 10 Gives Users the Finger (Literally)
May 4, 2015, 12:04 PM
AMD CEO: Windows 10 Will Launch at "The End of July"
April 20, 2015, 7:24 PM
Testers Trolled by Promise of Uninstallable Windows 10 Preview Build 10061
April 16, 2015, 2:52 PM
Rumors Heat up About 2016 Windows 10.1 (Windows "Redstone") Release
April 8, 2015, 9:26 PM
Most Popular Articles
America's Largest Cable Company, Comcast, Sees Internet Subscriptions Pass TV
May 4, 2015, 2:46 PM
Chromebooks Expected to See Sales Grow 26 Percent to 7.3 Million Units This Year
May 22, 2015, 1:26 PM
Don't Spy on Me: Senate Pushes Obama's PATRIOT Act Renewal Bid to the Brink
May 25, 2015, 8:21 PM
Buzzfeed, NatGeo, NBC, and NYT Pay to Push Stories to Your Facebook Feed
May 13, 2015, 4:31 PM
No Matter What the AP Tells You, Google's Self-Driving Cars are Pretty Safe
May 12, 2015, 1:06 PM
Latest Blog Posts
Sceptre Airs 27", 120 Hz. 1080p Monitor/HDTV w/ 5 ms Response Time for $220
Dec 3, 2014, 10:32 PM
Costco Gives Employees Thanksgiving Off; Wal-Mart Leads "Black Thursday" Charge
Oct 29, 2014, 9:57 PM
"Bear Selfies" Fad Could Turn Deadly, Warn Nevada Wildlife Officials
Oct 28, 2014, 12:00 PM
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
More Blog Posts
Copyright 2015 DailyTech LLC. -
Terms, Conditions & Privacy Information