I'm looking for information on what NSA suggested for use in commercial systems in past times. 90's and early 2000's.
I'm mainly interested in PKI and symmetric cyphers for SSL and file/disk encryption.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
what NSA suggested for use in commercial systems in past times. 90's and early 2000's.
NSA did not publicize their involvement in national standards. So, the exact role NSA played in algorithms and documents may be difficult to determine.
In 1987 the U.S. Congress passed the "Computer Security Act" which was intended to limit the role of the National Security Agency (NSA) in the development of civilian standards.. The act also authroized the U.S. government to develop standards for publicly available cryptography as most of the encryption up to this point was intended for military use.
The National Institute of Standards and Technology (NIST) had previously published FIPS 46 specifying The Data Encryption Standard in 1977. 1988 NIST issued FIPS 46-1 continuing to support DES. IN 1993 NIST published FIPS 46-2 which again supported DES. It wasn't until 1999 that NIST recommended using Tripple DES also known as 3DES.
In 1991 NIST published FIPS 186 The Digital Signature Standard (DSS). EPIC claims that the NSA actually produced the technology behind DSS. DSS became an official standard when approved by the U.S. Secretary of Commerce.
In 1994 NIST publishes FIPS 185 Escrowed Encryption Standard (EES) The most well know implementation of the standard was the Clipper Chip. EPIC describes Skipjack, the cryptographic algorithm used by ESS as 'developed by the National Security Agency' The Clipper Chip and ESS are failures whith little to no adoption. NIST also publishes FIPS 140-1 a standard for commercial development of cryptographic modules.
In 1995 NIST published FIPS 180 Secure Hash Standard (SHS) which describe the Secure Hash Algorithm (SHA-1). Wikipedia describes SHA-1 as being 'designed by the National Security Agency and published by the NIST'
In 1996 NIST publishes FIPS 186-1 a minor revision to FIPS 186 describing the Digital Signature Standard (DSS).
In 1997 NIST anounced the Advanced Encryption Standard competition. An open competition to select an algorithm to replace DES.
In 1999 NIST publishes FIPS 46-3 recommending Tripple DES (3DES) for new systems and the continued use of DES for legacy systems.
In 2001 NIST publishes FIPS 140-2 and makes revisions based on new technology and comments received from the vendor, tester, and user communities.
In 2002 NIST announced the winner of the AES competition and published FIPS 197 Advanced Encryption Standard (AES)
NSA was undergoing a transformation on the subject question during the timeframe you are questioning.
In the previous two decades through the mid 90s NSA advocated for no strong privately controlled public encryption. This position surfaced with their clash with MIT over the work of the famed RSA crew Ron Rivest, Adi Shamir, and Leonard Adleman resulting in the rushed publishing of same in 1976. Federal funding for MIT was threatened during that dust up. That position continued through the next 15 years highlighted by the flare up with Phil Zimmermann and PGP which almost landed him in prison. By 1993 NSA was advocating the ‘Clipper Chip’ solution (using Skipjack) which created a back door key escrow for all public encryption. The pushback against the concept was great from both academia and the common computer enthusiast. That sets the stage for the period you question.
Times were changing as the Cold War ended, BBS-based personal computing was replaced by web browsing based on the Netscape browser with its PKI SSL solution, and with those changing times so changed NSA. By July 2000 NSA had gone so far as to partner with Network Associates, the owners of Zimmerman’s PGP at that point, to create a free open source operating system – SELinux. NSA by that point embraced publically available encryption as we know it today and provided hardening recommendations using same. You can find specifics at http://www.nsa.gov/ia/guidance/security_configuration_guides/archived_guides.shtml . Keep in mind that NSA was actually just joining the public using commercial standards of the day in the period you are questioning.