Feeds

How much did NSA pay to put a backdoor in RSA crypto? Try $10m – report

Latest Snowden claims: Flawed encryption tech switched on by default in exchange for cash

Top 5 reasons to deploy VMware with Tegile

The mystery of why RSA would use a flawed, NSA-championed algorithm as the default random number generator for several of its encryption products appears to be solved, and the answer is utterly banal, if true: the NSA paid it to.

Reuters reports that RSA received $10m from the NSA in exchange for making the agency-backed Dual Elliptic Curve Deterministic Random Bit Generator (Dual EC DRBG) its preferred random number algorithm, according to newly disclosed documents provided by whistleblower Edward Snowden.

If that figure sounds small, that's because it is. Tech giant EMC acquired RSA for $2.1bn in 2006 – around the same time as the backroom NSA deal – so it seems odd that RSA would kowtow to the g-men so cheaply.

But according to Reuters, at the time, things weren't looking so good for the division of RSA that was responsible for its BSafe encryption libraries. In 2005, those tools brought in a mere $27.5m of RSA's $310m in annual revenue, or just 8.9 per cent.

By accepting $10m from the NSA, as Reuters claims, the BSafe division managed to increase its contribution to RSA's bottom line by more than a third.

It wasn't long after RSA switched to Dual EC DRBG as its default, however, that security experts began to question whether this new algorithm was really all it was cracked up to be. In 2007, a pair of Microsoft researchers observed that the code contained flaws that had the potential to open "a perfect backdoor" in any encryption that made use of it [PDF].

Such concerns remained largely within the province of security experts until earlier this year, when documents leaked by Snowden confirmed the existence of NSA-created backdoors in encryption based on RSA's technology.

In late September, RSA itself even warned its customers that they should choose a different cryptographically secure random number generator while it reviews its own products for potential vulnerabilities. OpenSSL, the software library used by countless applications to perform encryption and decryption, has also written off Dual EC DRBG. How the NSA came to be involved with the algorithm is discussed in detail here by computer security expert Bruce Schneier.

For its part, however, RSA maintains that it never conspired with the NSA to compromise the security of its products, and that if the government knew how to break RSA's encryption, it never let on.

"RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products," the company wrote in a canned statement. "Decisions about the features and functionality of RSA products are our own." ®

Internet Security Threat Report 2014

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.