Worried OpenSSL uses NSA-tainted crypto? This BUG has got your back

Discovered software blunder disabled distrusted random number generator


As fears grow that US and UK spies have deliberately hamstrung key components in today's encryption systems, users of OpenSSL can certainly relax about one thing.

It has been revealed that the cryptography toolkit – used by reams of software from web browsers for HTTPS to SSH for secure terminals – is not using the discredited random number generator Dual EC DRBG.

And that's due to a bug that's now firmly a WONTFIX.

A coding flaw uncovered in the library prevents "all use" of the dual elliptic curve (Dual EC) deterministic random bit generator (DRBG) algorithm, a cryptographically weak algorithm championed by none other than the NSA.

No other DRBGs used by OpenSSL are affected, we're told.

"The nature of the bug shows that no one has been using the OpenSSL Dual EC DRBG," Steve Marquess of the OpenSSL Software Foundation wrote yesterday in a mailing list post. He credited the find to Stephen Checkoway and Matt Green of the Johns Hopkins University Information Security Institute.

The bug in fips_drbg_ec.c can be fixed with a one-line change so that the Dual EC DRBG state is updated and its output used. It is a rare example of a software screwup that has beneficial side-effects.

Cryptographers have harboured suspicions about Dual EC DRBG for at least six years. The technology was disowned [PDF] earlier this year by US government tech standards body NIST, and people were warned by RSA, EMC's security division, to ditch the algo.

Computer scientists have come to believe that the algorithm's design was crippled during its development, effectively creating a backdoor [PDF] so that encryption systems that relied on it could be easily cracked. Such encryption systems rely on cryptographically secure random number generators to make them extremely hard to predict.

Given that Dual EC DRBG is "pretty much toxic for any purpose", we're told, there are no plans to fix the OpenSSL bug; doing so would be far more trouble than its worth. The best, and most straightforward, resolution of the problem is to snub the technology, which until recently came with a US government endorsement.

"A FIPS 140-2 validated module cannot be changed without considerable expense and effort, and we have recently commenced that process of entirely removing the Dual EC DRBG code from the formally validated module," Marquess added. ®

Similar topics


Other stories you might like

  • How to keep a support contract: Make the user think they solved the problem

    Look what you found! Aren't you clever!

    On Call Let us take a little trip back to the days before the PC, when terminals ruled supreme, to find that the more things change the more they stay the same. Welcome to On Call.

    Today's story comes from "Keith" (not his name) and concerns the rage of a user whose expensive terminal would crash once a day, pretty much at the same time.

    The terminal in question was a TAB 132/15. It was an impressive bit of kit for the time and was capable of displaying 132 characters of crisp, green text on a 15-inch CRT housed in a futuristic plastic case. Luxury for sure, unless one was the financial trader trying to use the device.

    Continue reading
  • Apple kicked an M1-shaped hole in Intel's quarter

    Chipzilla braces for a China-gaming-ban-shaped hole in future results, predicts more product delays

    Intel has blamed Apple's switch to its own M1 silicon in Macs for a dip in sales at its client computing group, and foreshadowed future unpleasantness caused by supply chain issues and China's recent internet crackdowns.

    Chipzilla's finances were robust for the third quarter of its financial year: revenue of $19.2 billion was up five per cent year over year, while net income of $6.8 billion was up 60 per cent compared to 2020's Q3.

    But revenue for the client computing group was down two points. CFO George Davis – whose retirement was announced today – was at pains to point out that were it not for Apple quitting Intel silicon and Chipzilla exiting the modem business, client-related revenue would have risen ten per cent.

    Continue reading
  • How your phone, laptop, or watch can be tracked by their Bluetooth transmissions

    Unique fingerprints lurk in radio signals more often than not, it seems

    Over the past few years, mobile devices have become increasingly chatty over the Bluetooth Low Energy (BLE) protocol and this turns out to be a somewhat significant privacy risk.

    Seven boffins at University of California San Diego – Hadi Givehchian, Nishant Bhaskar, Eliana Rodriguez Herrera, Héctor Rodrigo López Soto, Christian Dameff, Dinesh Bharadia, and Aaron Schulman – tested the BLE implementations on several popular phones, PCs, and gadgets, and found they can be tracked through their physical signaling characteristics albeit with intermittent success.

    That means the devices may emit a unique fingerprint, meaning it's possible to look out for those fingerprints in multiple locations to figure out where those devices have been and when. This could be used to track people; you'll have to use your imagination to determine who would or could usefully exploit this. That said, at least two members of the team believe it's worth product makers addressing this privacy weakness.

    Continue reading

Biting the hand that feeds IT © 1998–2021