Re: [TLS] Extended random is NSA backdoor

[Nico Williams <[e-mail]>]

On Mon, Mar 31, 2014 at 8:51 PM, Michael D'Errico <[e-mail]> wrote:
> Nico Williams wrote:
>> If this is in reference to Dual_EC, well, TLS has always had enough
>> bytes of nonce to exploit the conjectured Dual_EC backdoor (assuming
>> one did not feel forced to send the 32 bits of Unix time, which,
>> indeed, some libraries _don't_).
>
> Would a mitigation be to take 64 bytes of DRBG output, run it through
> SHA-256 and use the result as the 32-byte (client|server) random?

Yes.  You don't need 64 bytes either.  Just 32, or 24 even, would
suffice.  The Dual_EC outputs have structure which is needed in order
to exploit the putative backdoor.  Hashing makes that structure
inaccessible to the attacker.

Nico
--