Re: [Cfrg] Dual_EC_DRBG

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 27/12/2013 20:43, Dan Brown wrote:

> Repeating myself, nobody showed how the alternative P&Q could be
> backdoored.

Yes, they did. Even with another point, Dual_EC_DRBG still doesn't
produce uniform random numbers (2^28 distinguisher¹, and a p=0.0011
consecutive bit predictor² - both of which are practical attacks).

So, if you use it to generate k for (DSA|ECDSA) signatures... or,
heaven forbid, a key...

It is thoroughly unsuitable as a CSPRNG, and is obviously broken by
design, as was widely pointed out at the time, even before we knew for
sure NSA had a hand in it.

> I would even want them to clearer.

I would want it removing from the standard entirely, as thoroughly and
completely discredited.

> Reported, yes.  But AFAIK, not published.

Unless you know of another EC-based RNG published by NIST in 2006,
all doubt has been removed that it is, in the NSA's words, 'enabled'.

Moreover, the internal NSA memo discussed by NYT might literally name
you, given your name is on the patent³ along with Vanstone, so I would
understand why you might have a vested interest in its publication.
You'd have to ask NYT for that, I suppose.

I'm going to ask you directly, Dan: Have you had any contact with the
 SIGINT Enabling Project that you know of? I mean, you even talk
specifically about "escrow keys" in that patent. That seems directly
relevant to their work.

___
1. Shoenmakers & Sidorenko [2006] <http://eprint.iacr.org/2006/190.pdf>
2. Gjøsteen [2005], comments to draft NIST SP 800-90A
3. <http://patents.justia.com/patent/8396213>

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJSwYz0AAoJEOyEjtkWi2t6JPkP/115U2z4sYiiPdq0ARDZEqVD
ujklAkflEBPawWXFla9yfhYzek272f3y8W12iyPr9cA4GAfxiiZv4/ycoQC1Js6w
lWCW14lWoJv1RCs5wsZjGLLMAMCqa24oEVcVqcVgV9JEnpwTj7zSjLrJ/MMyI91w
vhtdspZSA1MI+ik3FpuSR89Ooqo65s/KCWXGrt3oDfI6myozenS50bV4QYMQCCjC
APU+WtcCg+yDhovjN653Y8ZnEWqtPgC3OsZ1cK5pNJxJ4lqL6z2bicgUXVfHmlCW
Eq3bmPLQ+PZ1qM1o7c+BjSsapgQl1eERxAXsLhrJ/qU28+BK5oStQjfldZE9B/pP
0XrW/ZfYaTbcK9qzVZXlF1vFHW2tAfl226Q2MiJRnieqaCwaXlEm7GkbcYc9WAwu
9JjHfpn6jJ1vQ6mAuCUcrG8INa9hYQdKr/a/eWxOhaBqeVLOfNfEEOifgsGzQiJJ
ne5lnrDNe+HfYXZZr1BA+Sf7VLi+EYL5BWWV+QtKCUOVGQNZKk9VX0hoxQUGzBoG
eSvlmbg8k/ADfWnrSXUA3pP6eMpKKpbKkSwRsJQO2GR2dQTLodjKLU2PlzPRLnBm
7E5iz24KqHaOwMC67ENLUTPZpbaOi62mlFAjT0Sr1q8Ys6ZT49oDFVwXIbMdqH1R
ScguPThvXkj95mxAcFwp
=/B2W
-----END PGP SIGNATURE-----