# Does Microsoft use Dual_EC_DRBG by default?

So, as we all know, Dual_EC_DRBG contains an NSA back door. At this point, there is no reason to call it a "potential" or even an "alleged" back door; the presence is obvious even to the NY Times.

As we also know, RSA BSAFE has been using Dual_EC_DRBG by default, with a justification so stupid it can only be translated as "because NSA paid us to".

This comment on Ars Technica asserts that Microsoft also uses this generator. But I have seen claims to the contrary. Thus my questions are:

What PRNG does Windows Server use to generate private keys for Certificate Signing Requests?

What PRNG does Internet Explorer on Windows use to generate session keys? How about Chrome and Firefox on Windows?

What PRNG does IIS on Windows use to generate ephemeral key material for PFS?

I am most interested in the latest versions of all of these products, and certainly only those released after 2007. References or at least an air of authority are preferred.

-

According to the BCryptGenRandom documentation

The default random number provider implements an algorithm for generating random numbers that complies with the NIST SP800-90 standard, specifically the CTR_DRBG portion of that >standard.

Specifically, according to this the default value is BCRYPT_RNG_ALGORITHM which is:

The random-number generator algorithm.Standard: FIPS 186-2, FIPS 140-2, NIST SP 800-90

Note Beginning with Windows Vista with SP1 and Windows Server 2008, the random number generator is based on the AES counter mode specified in the NIST SP 800-90 standard.

Windows Vista: The random number generator is based on the hash-based random number generator specified in the FIPS 186-2 standard.

Windows 8: Beginning with Windows 8, the RNG algorithm supports FIPS 186-3. Keys less than or equal to 1024 bits adhere to FIPS 186-2 and keys greater than 1024 to FIPS 186-3.

An obvious questions is if this is actually the random number generator running. It would be very easy of course to change the value of BCRYPT_RNG_ALGORITHM to BCRYPT_RNG_DUAL_EC_ALGORITHM, especially to specifically target systems or for targeted regions. Given that DUAL_EC_DRBG has a bias, this is testable, but I don't think anyone would typically check.

-
This reads like nonsense. (Microsoft's documentation, I mean, not your answer.) What does "keys less than or equal to 1024 bits" even mean in the context of these PRNGs? I read this as saying something changed in Windows 8, but the tech writer does not understand what. Note that FIPS 186-3 is the first revision to incorporate SP 800-90 where the dual EC generator is specified. So Microsoft's language here does not preclude Windows 8 using Dual_EC_DRBG by default. –  Nemo Sep 21 '13 at 18:41
I think this means for key generation, depending on the specified key length request, they use different RNGs. –  imichaelmiers Sep 21 '13 at 20:31
Not sure about that. How does BCryptGenRandom know what you plan to use the random bits for? Also, would you say this wording implies Windows 8 uses AES counter mode? It looks to me like it just says it "supports FIPS 186-3" which could mean any RNG in SP 800-90. In fact, this wording seems to make a distinction between Vista SP1 / Server 2008 and Windows 8. The real question is what RNG BCryptGenerateKeyPair uses, and I do not think we know the answer yet. –  Nemo Sep 21 '13 at 20:46
@Nemo BCryptGenRandom does not have to know what to use the random bits for. It is the key generator that chooses which RNG to use. If you have got your own key generator, then above does not apply. In general, if the algorithm is present then you cannot be sure of any key pairs generated by windows unless you know the precise implementation. Same goes if you create your own keys, the only thing you can do to avoid the broken PRNG is to test for the bias or to know the actual implementation of the PRNG you are using. –  owlstead Sep 22 '13 at 15:19