Denial follows allegations that pioneering company made NSA algorithm its default in return for payment
The security company RSA has denied that it knowingly weakened the encryption it used in its products as part of a secret contract with the US's National Security Agency.
A report from the Reuters news agency on Friday alleged that RSA arranged a $10m contract to use a mathematically weaker formula in a number of its products, which would in effect have created a "back door" for cracking encrypted messages or communications.
RSA initially declined to respond to the reports. But in a blogpost on its site posted Sunday, the company now says: "Recent press coverage has asserted that RSA entered into a 'secret contract' with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries. We categorically deny this allegation."
It adds that "We have worked with the NSA, both as a vendor and an active member of the security community. We have never kept this relationship a secret and in fact have openly publicized it. Our explicit goal has always been to strengthen commercial and government security."
The amount described would have been a substantial boost to RSA's revenues – totalling about a third of the revenue for the relevant division in the previous year.
Damien Miller, a security researcher at Google, commented that the blogpost might qualify for "carefully worded press release of the year". RSA's statement seems to deny knowing at the time of any contract that the random number generator was flawed. But clear details about its weakness have only emerged in the past few months, while the alleged contract would have been undertaken in at least six years ago.
Reuters alleges that the NSA paid RSA to make Dual EC DRBG the default method for generating numbers in its Bsafe software. Most people stick with the defaults in any software they use – even in cryptography.
"We made the decision to use Dual EC DRBG as the default in BSafe toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption," the company says. "At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption."
Disclosures from the whistleblower Edward Snowden have revealed that the NSA worked to weaken the random number generation in the system, which would make any communications much easier to crack.
The Dual EC DRBG algorithm was approved by the US National Institute of Standards and Technology (NIST) in 2006, but concern was raised by two researchers from Microsoft the net year that it had a "back door" in it.
NIST has since recommended that the algorithm is not used to generate secure content.
source: http://www.theguardian.com/technology/2013/dec/23/security-company-rsa-denies-installing-nsa-back-door
A report from the Reuters news agency on Friday alleged that RSA arranged a $10m contract to use a mathematically weaker formula in a number of its products, which would in effect have created a "back door" for cracking encrypted messages or communications.
RSA initially declined to respond to the reports. But in a blogpost on its site posted Sunday, the company now says: "Recent press coverage has asserted that RSA entered into a 'secret contract' with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries. We categorically deny this allegation."
It adds that "We have worked with the NSA, both as a vendor and an active member of the security community. We have never kept this relationship a secret and in fact have openly publicized it. Our explicit goal has always been to strengthen commercial and government security."
The amount described would have been a substantial boost to RSA's revenues – totalling about a third of the revenue for the relevant division in the previous year.
Damien Miller, a security researcher at Google, commented that the blogpost might qualify for "carefully worded press release of the year". RSA's statement seems to deny knowing at the time of any contract that the random number generator was flawed. But clear details about its weakness have only emerged in the past few months, while the alleged contract would have been undertaken in at least six years ago.
Elliptic curve
The weakened encryption system – a random number generator known as Dual EC DRBG – is the default for a number of security "toolkits" built by RSA which it then issues to other companies. It also figures in its own products. It relies on an algorithm known as "Dual elliptic curve" – Dual EC – which was developed by the NSA.Reuters alleges that the NSA paid RSA to make Dual EC DRBG the default method for generating numbers in its Bsafe software. Most people stick with the defaults in any software they use – even in cryptography.
"We made the decision to use Dual EC DRBG as the default in BSafe toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption," the company says. "At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption."
Disclosures from the whistleblower Edward Snowden have revealed that the NSA worked to weaken the random number generation in the system, which would make any communications much easier to crack.
The Dual EC DRBG algorithm was approved by the US National Institute of Standards and Technology (NIST) in 2006, but concern was raised by two researchers from Microsoft the net year that it had a "back door" in it.
NIST has since recommended that the algorithm is not used to generate secure content.
source: http://www.theguardian.com/technology/2013/dec/23/security-company-rsa-denies-installing-nsa-back-door
