Re: [Cfrg] Dual_EC_DRBG ... [was RE: Requesting removal of CFRG co-chair]

[Adam Back <[e-mail]>]

I think I stayed extremely far away from anything conspiratorial, and I
remind you to please keep your responses civil.

To counter your unfounded attack, now I have to explain, I quoted Dan Brown
who said in the mail I was replying to:

> 5. Either CMVP or CAVP (I forget which) insisted on the default P and Q. 
> But the stated purpose of these validation programs, IIRC, is only to
> protect communication with USG/CAG, in which the user is already trusting
> these entities extensively.  I'm not aware of any promises to protect
> non-USG communication in the CMVP or CAVP.

I do actually have multiple first hand experiences working with
certification labs, one of them may even have been cygnacom (I forget, was
some time ago but it rings a bell).  Anyway take up your complaint with Dan
who claimed the above (offlist if you like).  All I could say first hand is
the evaluation process is typically a documentation/tracing exercise
following the letter of the relevant standards and validation procedures. 
If a lab interpreted EC_DRBG spec as requiring that specific P & Q to be
used, that could be a neutral action (or not).  Its imposible to say.

It would not be the first time at least that for procedural reasons lab
decisions have actually hindered product security from what I've heard.  The
labs job is to certify adherence to a documented standard, not to help the
company make a secure product.  Sometimes standards inflexibility conflicts
with product security.  Often you can work around it - get certification and
make a secure product.  Certification is still a useful minimum bar and
accrediation process.

If you work for cygnacom in this area, I'm sure you've come across such
conflicts yourself.

Adam

On Fri, Dec 27, 2013 at 07:15:03PM +0000, Santosh Chokhani wrote:
>Validation labs do not get or want money for backdoors.
>
>So, either quit your conspiratorial nonsense or take it to Hollywood,
>
>-----Original Message-----
>From: Cfrg [mailto:[e-mail]] On Behalf Of Adam Back
>Sent: Friday, December 27, 2013 2:09 PM
>To: Dan Brown
>Cc: Adam Back; '[e-mail]'
>Subject: Re: [Cfrg] Dual_EC_DRBG ... [was RE: Requesting removal of CFRG co-chair]
>
>Dan Brown wrote:
>> [...]
>> 8. All considered, I don't see how the ANSI and NIST standards for
>> Dual_EC_DRBG can be viewed as a subverted standard, per se.
>
>Of course they're subverted.  We have Ferguson et al show how they could be backdoored.  We have internal NSA documents reported as talking about the subversion.  We have confirmation of RSA (inadvertently or not) accepting money to put a EC_DRBG as a default.  You yourself just said the validation labs are demanding the backdoored P & Q be used (and rejecting the provably uncooked implemented chosen parameters presumably).  NIST put the standard forward (inadvertently or not) from NSA input.
>
>I am non-plussed at what you could be trying to say with the above statement.
>
>Adam
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>http://www.irtf.org/mailman/listinfo/cfrg