6
$\begingroup$

Assume that some entity really holds the private key corresponding to the recommended/dubious constants of Dual_EC_DRBG.

According to this presentation, they would be able to reconstruct the internal state from only 32 bytes of random output and thereby predict all future output as well.

Would the backdoor also allow recovering previous output of the RNG, or does the resistance against state compromise extensions still hold in that situation?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

State update takes $s$ to $x(sP)$, so you would have to compute d.log.s to run the state backwards.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Is that computationally hard, even knowing all (potentially) hidden curve parameters? $\endgroup$
    – lxgr
    Commented Sep 12, 2013 at 18:03
  • 1
    $\begingroup$ As far as is known, yes. If the curve is in some sense weak and d.log.s are easy to compute, then you could break the generator without faking the generation of the Q point. $\endgroup$
    – K.G.
    Commented Sep 12, 2013 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.