Worried OpenSSL uses NSA-tainted crypto? This BUG has got your back
Discovered software blunder disabled distrusted random number generator
As fears grow that US and UK spies have deliberately hamstrung key components in today's encryption systems, users of OpenSSL can certainly relax about one thing.
It has been revealed that the cryptography toolkit – used by reams of software from web browsers for HTTPS to SSH for secure terminals – is not using the discredited random number generator Dual EC DRBG.
And that's due to a bug that's now firmly a WONTFIX.
A coding flaw uncovered in the library prevents "all use" of the dual elliptic curve (Dual EC) deterministic random bit generator (DRBG) algorithm, a cryptographically weak algorithm championed by none other than the NSA.
No other DRBGs used by OpenSSL are affected, we're told.
"The nature of the bug shows that no one has been using the OpenSSL Dual EC DRBG," Steve Marquess of the OpenSSL Software Foundation wrote yesterday in a mailing list post. He credited the find to Stephen Checkoway and Matt Green of the Johns Hopkins University Information Security Institute.
The bug in fips_drbg_ec.c can be fixed with a one-line change so that the Dual EC DRBG state is updated and its output used. It is a rare example of a software screwup that has beneficial side-effects.
Cryptographers have harboured suspicions about Dual EC DRBG for at least six years. The technology was disowned [PDF] earlier this year by US government tech standards body NIST, and people were warned by RSA, EMC's security division, to ditch the algo.
Computer scientists have come to believe that the algorithm's design was crippled during its development, effectively creating a backdoor [PDF] so that encryption systems that relied on it could be easily cracked. Such encryption systems rely on cryptographically secure random number generators to make them extremely hard to predict.
Given that Dual EC DRBG is "pretty much toxic for any purpose", we're told, there are no plans to fix the OpenSSL bug; doing so would be far more trouble than its worth. The best, and most straightforward, resolution of the problem is to snub the technology, which until recently came with a US government endorsement.
"A FIPS 140-2 validated module cannot be changed without considerable expense and effort, and we have recently commenced that process of entirely removing the Dual EC DRBG code from the formally validated module," Marquess added. ®