Gov’t standards agency “strongly” discourages use of NSA-influenced algorithm
Source: Ars Technica
Following revelations about the National Security Agency's (NSA) covert influence on computer security standards, the National Institute of Standards and Technology, or NIST, announced earlier this week it is revisiting some of its encryption standards. But in a little-noticed footnote, NIST went a step further, saying it is "strongly" recommending against even using one of the standards.
The institute sets standards for everything from the time to weights to computer security that are used by the government and widely adopted by industry.
As ProPublica, The New York Times, and The Guardian reported last week, documents provided by Edward Snowden suggest that the NSA has heavily influenced the standard, which has been used around the world. In its statement Tuesday, the NIST acknowledged that the NSA participates in creating cryptography standards "because of its recognized expertise" and because the NIST is required by law to consult with the spy agency. "We are not deliberately, knowingly, working to undermine or weaken encryption," NIST chief Patrick Gallagher said at a public conference Tuesday.
Various versions of Microsoft Windows, including those used in tablets and smartphones, contain implementations of the standard, though the NSA-influenced portion isn't enabled by default. Developers creating applications for the platform must choose to enable it.
Read more: http://arstechnica.com/security/2013/09/government-standards-agency-strongly-suggests-dropping-its-own-encryption-standard/
The algorithm in question uses Elliptic Curve cryptography to generate pseudo-random numbers that are supposed to be suitable for cryptographic purposes.
As it turns out, the NSA may have insisted on using an elliptic curve constant that may be of a class of constants that are cryptographically weak, meaning the NSA knows how to crack them easily.
When another federal agency is saying "Don't use this algorithm," it's time to listen!
= new reply since forum marked as read
