Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

After reading this article about RSA advising its customers not to use the default random-number generator in its encryption products - amid fears spooks can easily crack data secured by the algorithm, what products need immediate attention and configuration change? Does it affect the hardware token generators used for two factor authentication from RSA?

share|improve this question

closed as too broad by TildalWave, Adnan, Xander, Gilles, NULLZ Oct 2 '13 at 23:12

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
See Who uses Dual_EC_DRBG? –  Gilles Oct 2 '13 at 12:41

1 Answer 1

up vote 2 down vote accepted

(*cough* alleged ability *cough*)

TL;DR: There is widespread use of BSAFE, and widespread availability of (though not necessarily use of) Dual_EC_DRBG. Though there is a lack of definitive vendor statements at this time, there is an unsubstantiated claim that SecureID is not at risk from this, and other than a single McAfee product, nothing seems immediately at risk.

The crypto.se question Who uses Dual_EC_DRBG? doesn't identify many actual products, primarily just the RSA BSAFE developer library.

The actual RSA advice/statement (presumably limited release) appears at the end of this article. In that Wired claim to have a source who states no SecureID (hardware or software) uses the affected PRNG. Since it could be quite expensive and embarrassing if it was the case, you may choose to disbelieve this ;-)

Since we know the RSA BSAFE library uses Dual_EC_DRBG (inexplicably, since there has been suspicion hanging over this PRNG since 2007) by default, I would guess that this would be the main vector, and your question should be answered by D.W.'s similar crypto.se question Who uses the RSA BSAFE library?, which is unanswered at this time ...

This rather old (1998) and slightly ironic RSA Bulletin Preliminary Analysis of the BSAFE 3.x Pseudorandom Number Generators (PDF) opens with:

An enormous number of commercial applications (over 350 million copies) rely on the BSAFE and JSAFE toolkits from RSA Data Security to generate cryptographically strong pseudorandom numbers

hinting at the potential scale 15 years ago, and prior to the freely available version (and also prior to the affected algorithm).


Given the lack of a CVE, the NIST DRBG Validation List (Google cached copy) is probably a good start (though not necessarily a comprehensive list). Vendors with validated Dual_EC_DRBG implementations include Juniper, Cisco, RIM, Symantec, Riverbed, McAfee, SafeNet, Microsoft and OpenSSL. Only terse information about products is given, if any.

See this article for some (unsubstantiated) vendor statements: http://www.crn.com/news/security/240161911/cisco-mcafee-other-firms-addressing-nsa-linked-encryption-algorithm.htm

Regarding OpenSSL, it's not the default PRNG, and soon won't be supported at all.

McAfee Firewall Enterprise Control Center (uses BSAFE) only uses Dual_EC_DRBG in FIPS deployments

Several versions of MS-Windows support Dual_EC_DRBG, somewhat ironically (PDF) but it's not a default, though as Schneier says:

“A Trojan is really, really big. You can’t say that was a mistake. It’s a massive piece of code collecting keystrokes,” he said. “But changing a bit-one to a bit-two [in the registry to change the default random number generator on the machine] is probably going to be undetected. It is a low conspiracy, highly deniable way of getting a backdoor. So there’s a benefit to getting it into the library and into the product.”


As for the use of BSAFE, I can easily find (hint: use your favourite search engine to search for the terms "This product includes" "RSA BSAFE") implementations, oddly skewed towards imaging and gaming devices:

  • surprisingly many printer/copier/fax devices use BSAFE, though for unknown purposes. Including Ricoh, Minolta, Océ/Canon, Brother, Fuji/Xerox, Epson ...
  • Your Playstation (PDF), PSP, or your Nintendo DS wifi (PDF)
  • Software from Adobe, Hitachi, Oracle and HP
  • Some Nokia phones(PDF)
share|improve this answer
    
Great details mr.spuratic. If the support for this Dual_EC_DRBG is not removed from the products, the residual risk and the initial risk are almost the same just like stated by Schneier. Now everyone should be thinking what else could have been hidden as well by NSA?. Will other governments start investing on their own encryption suites? –  AdnanG Oct 3 '13 at 4:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.