Feeds

How much did NSA pay to put a backdoor in RSA crypto? Try $10m – report

Latest Snowden claims: Flawed encryption tech switched on by default in exchange for cash

Intelligent flash storage arrays

The mystery of why RSA would use a flawed, NSA-championed algorithm as the default random number generator for several of its encryption products appears to be solved, and the answer is utterly banal, if true: the NSA paid it to.

Reuters reports that RSA received $10m from the NSA in exchange for making the agency-backed Dual Elliptic Curve Deterministic Random Bit Generator (Dual EC DRBG) its preferred random number algorithm, according to newly disclosed documents provided by whistleblower Edward Snowden.

If that figure sounds small, that's because it is. Tech giant EMC acquired RSA for $2.1bn in 2006 – around the same time as the backroom NSA deal – so it seems odd that RSA would kowtow to the g-men so cheaply.

But according to Reuters, at the time, things weren't looking so good for the division of RSA that was responsible for its BSafe encryption libraries. In 2005, those tools brought in a mere $27.5m of RSA's $310m in annual revenue, or just 8.9 per cent.

By accepting $10m from the NSA, as Reuters claims, the BSafe division managed to increase its contribution to RSA's bottom line by more than a third.

It wasn't long after RSA switched to Dual EC DRBG as its default, however, that security experts began to question whether this new algorithm was really all it was cracked up to be. In 2007, a pair of Microsoft researchers observed that the code contained flaws that had the potential to open "a perfect backdoor" in any encryption that made use of it [PDF].

Such concerns remained largely within the province of security experts until earlier this year, when documents leaked by Snowden confirmed the existence of NSA-created backdoors in encryption based on RSA's technology.

In late September, RSA itself even warned its customers that they should choose a different cryptographically secure random number generator while it reviews its own products for potential vulnerabilities. OpenSSL, the software library used by countless applications to perform encryption and decryption, has also written off Dual EC DRBG. How the NSA came to be involved with the algorithm is discussed in detail here by computer security expert Bruce Schneier.

For its part, however, RSA maintains that it never conspired with the NSA to compromise the security of its products, and that if the government knew how to break RSA's encryption, it never let on.

"RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products," the company wrote in a canned statement. "Decisions about the features and functionality of RSA products are our own." ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.