Re: [Cfrg] Dual_EC_DRBG ... [was RE: Requesting removal of CFRG co-chair]

[Henrick Hellström <[e-mail]>]

On 2013-12-27 21:43, Dan Brown wrote:
>> We have confirmation of RSA (inadvertently or not)
>> >accepting money to put a EC_DRBG as a default.
> My conclusion was regarding the standards, per se, not about
> implementations. I was not drawing any conclusions about implementations.

I think that is a mistake. It is a problem if a library that is widely 
used and even got certified, are using default parameters that are 
potentially backdoored. The relevant question isn't whether *any* 
standard compliant implementation will have a backdoor, but if it is 
possible to have a backdoor in an implementation and still get it certified.

That said, I am not entirely convinced NSA actually intended to put a 
backdoor in Dual EC DRBG, or rather, that this standard was part of the 
SIGINT enabling program. For all I know, it could just as well be a case 
of them generating the parameters randomly because they for some reason 
didn't trust the usual binary expansion of pi approach.