Hacker News Reader

Comment by tptacek | Hacker News Reader

This is devastating news... for an entire generation of NIST cryptography conspiracy theories.

It’s perplexing that NIST chose to burn so much trust and goodwill with the independent cryptography community instead of just explaining empirically that they really had nothing up their sleeve.

It was a very different time back then.

What was so different, culturally?

Well the thing that comes to mind for me was the US gov classing encryption as a munition and placing it under export controls

That was more early-mid 1990s, and not so much late-90s and early 2000s, when the NIST/NSA issues came about (from what I understand)

Still is. It's still illegal to export cryptography without permission.

Everybody exports strong cryptography without permission today.

This was the era of export cryptography, just after the Clipper Chip saga, "this t-shirt is a munition, and perhaps most importantly curve cryptography was barely a thing (this is back at the time where people believed the Certicom patents would preclude it from deployment). I think people just weren't paying that much attention to cryptographic standards processes at all, at least not for a couple more years (remember, the curves were generated years before they were published).

In 2000 I installed Steve Gibson research’s “shields up” firewall onto my Windows 98 desktop so that my home printer would stop printing random things people on the internet sent to it because it was fully publicly shared on the internet (I didn’t do that on purpose). Every website defaulted to http back then and https was to be avoided unless absolutely necessary because it was slower… a very different time!

Don’t “rand()” PRNG libraries usually seed with current UNIX time by default iF no seed is provided?

It's lrand48, an LCG that might precede Unix. Without an explicit seed it has a standard constant starting seed.

I am guessing you installed Zone Alarm or BlackICE, or possibly configured your router, and then used Steve’s Shields Up to test your work. Shields up is a tool to scan your open ports.

"independent cryptography community" - I actually LOLed at this

I don't think that "community" would accept any kind of answer as truthful so why waste the time...

It’s independently verifiable. What do you mean?

One of the top comments in this very thread suggests the seed timestamps were maybe selected specifically for purpose.

After Dual_EC_DRBG, there is no longer justification for any attitude towards the NSA other than suspicion and skepticism. Everything should be assumed a potential attack vector and thoroughly explored. I thank the community for carrying this torch for so many years.

NSA != NIST

Yes, and the NSA generated the seeds for NIST. This is public knowledge and is acknowledged in the article.

It has been the entire focus of the backdoor concerns since the curves were adopted over 20 years ago and is the motivation for the work behind this article.

It's not a crazy question to ask / theory to posit. The next message down explains why it's unlikely and the whole conversation sounds reasonable to me.

The cryptgraphy community is pretty reasonable folks, on the whole.

So is Earth's sphericity.

I think they legitimately did not know. The person who worked on it directly, Jerry Solinas, did not remember and gave an explanation that turned out to be wrong. In his defense, multiple people told the same story about hashing a phrase that was wrong.

If they did know, they could have handed over these timestamps 15 years ago and put the issue to bed.

If they deny everything they didn't do, then whatever they don't deny will stand out.

I'm more surprised a different set of numbers wasn't selected

This hardly proves the NSA has nothing up their sleeve.

If I was the NSA, I'd just make a huge rainbow table of all (timestamp hashes, passphrase hashes of every book/movie, random sentences, etc), then generate huge numbers of (seed, secret key) pairs and pick the first one that matches.

Voila. All the crypto backdoor and a side of plausible deniability if anyone decodes the seed.

Bonus points if the exact "rainbow table" algorithm couldn't recover the original seed, so that's why NSA couldn't tell us where it came from. :)

Thank god NIST gifted us Dual_EC_DRBG, so I still have a NIST Elliptic Curve effort I can sneer at dismissively.

RSA was good enough for my grandfather, and it's good enough for me.

It would be helpful, for your sneering, to understand that Dual EC is not in fact a NIST elliptic curve.

But why that specific timestamp? They probably kept trying different timestamp hashes until they found one with a vuln

I don't know why, but 2^32 search space is WAY too small. Anything they could enumerate back then (or even today) is way too small. This is like saying they tried four times before they found a vulnerable one.

LCG generators like lrand48 have been understood well enough you could possibly calculate "realistic looking timestamp" input seeds based on intended output characteristics.

Now, do we think that's likely? Probably no more likely than then being "easily broken" for decades without being noticed by the academic cryptography community.

Reply on news.ycombinator.com