Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Given the recent revelations of the NSA engineering a backdoor into the Dual_EC_DRBG algorithm - I'm curious, exactly how, given the number of variables involved in generating the random bits could the NSA be able to reproduce the bits as and when they like?

My understanding of these systems is that it takes into account many different variables so how would the NSA be able to recreate those conditions, even with a backdoor?

share|improve this question
when you know the secret values built into the default configuration of dual-ec, then observing a short output is enough to recover the internal state and predict all other outputs until the next big entropy mixin. –  CodesInChaos Sep 11 '13 at 18:57
Makes me think: how can we know how the NSA would be able to do it? If we knew what the NSA is able to do (and how), whistleblowers wouldn't be able to surprise us. –  e-sushi Sep 11 '13 at 19:20
@CodesInChaos do you have an simple example of that process? Obviously I don't expect you to show how it works in the Dual EC DRBG case. –  Ryan McDonough Sep 11 '13 at 19:40
"Predicting PRNG given some of its previous output" may provide some good hints towards an "example"… –  e-sushi Sep 12 '13 at 1:40
@e-sushi thanks for that link, that's quite interesting. –  Ryan McDonough Sep 12 '13 at 6:51
show 1 more comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.