9
$\begingroup$

On article at => Microsoft Docs

CNG Algorithm Identifiers

I notice that BCRYPT_RNG_DUAL_EC_ALGORITHM is now removed since Windows 10.

Beginning with Windows 10, the dual elliptic curve random number generator algorithm has been removed. Existing uses of this algorithm will continue to work; however, the random number generator is based on the AES counter mode specified in the NIST SP 800-90 standard. New code should use BCRYPT_RNG_ALGORITHM, and it is recommended that existing code be changed to use BCRYPT_RNG_ALGORITHM.

Does this imply that Elliptic Curve PRNG is considered unsecure already?

The Government's elliptic curve backdoor is real, isn't it?

Improve this question
$\endgroup$
3
  • 4
    $\begingroup$ Also note that Dual-EC was quite slow, barely used and prone to either having a NSA-based backdoor in the default parameters and was also prone to having its parameters replaced for a custom backdoor (which actually happened!). $\endgroup$
    – SEJPM
    Commented Jul 23, 2018 at 9:39
  • $\begingroup$ We do not need proof to distrust anything. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jul 23, 2018 at 12:51
  • 2
    $\begingroup$ @MaartenBodewes in this case we actually even have proof to distrust it ;) $\endgroup$
    – SEJPM
    Commented Jul 23, 2018 at 13:00

1 Answer 1

Reset to default
19
$\begingroup$

The Government's elliptic curve backdoor is real, isn't it?

We don't know for sure, but there are indicators into that direction. More importantly though,

Does this imply that Elliptic Curve PRNG is considered unsecure already?

As you saw above, using Dual-EC can be a real exploitable risk. There are however additional reasons why Dual-EC isn't the greatest random number generator and why people wouldn't want to use it:

  • It's no longer in the list of NIST specified RNGs and was removed from SP 800-90A rev.1.
  • It's very slow compared to all the other "approved" RNGs (like three orders of magnitude slower).
  • It doesn't even have a security proof, which is the only reason why you would want to use such a slow RNG in the first place and more specifically...
  • It's output is actually distinguishable from random (which is like the bare minimum of a security guarantee no RNG should violate)!

So TL;DR: Yes, the Dual-EC is backdoorable and slow and not even properly random and was probably dropped because of that.

Additional reading: Matthew Green's blog post on the subject (which is also a source for this answer) as well as Bernstein's, Lange's and Niederhagen's "Dual EC: A Standardized Back Door".

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Another paper: Dual EC: A Standardized Back Door $\endgroup$
    – allo
    Commented Jul 23, 2018 at 14:23
  • $\begingroup$ @allo (1) NSA was informed about Dual-EC exploitation April 2005. (2) Dual EC made appearance in the industry standard body SP 800-90 in June 2006. (3) A month later, Dual-EC exploitation appeared in public patent filing in July 2006. So I guess what we can bring home is that standardization an exploit always takes a shorter length of time than writing a quiet patent for approximately 30 days. So that the public perception is that the standard would be just accidentally naive. $\endgroup$
    – sandthorn
    Commented Jul 23, 2018 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.