Questions tagged [dual-ec-drbg]

Dual-ec-drbg is short for Dual Elliptic Curve Deterministic Random Bit Generator; a pseudorandom number generator based on the elliptic curve discrete logarithm problem.

Filter by
Sorted by
Tagged with
2 votes
1 answer
147 views

Generating pseudorandom numbers using Dual_EC_DRBG

I am currently learning about the Dual_EC_DRBG protocol and I am stuck at the calculation of the initial state with the point P. For context, I am using the secp256k1 curve with a = 0 and b = 7. I ...
1 vote
0 answers
129 views

What’s the relationship between P-256 and Dual EC DRBG?

It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it. With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
52 votes
6 answers
18k views

Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
2 votes
1 answer
103 views

Mathematical proof or any reference of "Deterministic random bit generator cannot produce more randomness than the randomness of seed"

The heading tells everything. Any proof or any kind of reference is welcome regarding this: Can we get more randomness from a deterministic random bit generator than the entropy that we feed to the ...
39 votes
1 answer
31k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
6 votes
1 answer
347 views

What exactly could be accomplished with a backdoor in Dual_EC_DRBG?

Assume that some entity really holds the private key corresponding to the recommended/dubious constants of Dual_EC_DRBG. According to this presentation, they would be able to reconstruct the internal ...
7 votes
1 answer
1k views

Does the backdoor in Dual_EC_DRBG work like that?

From what I read, the backdoor in Dual_EC_DRBG operates by using related $P$ and $Q$ points. Did I understand the idea correctly? Dual_EC_DRBG works by multiplying the $P$ point with the seed ...
9 votes
1 answer
1k views

Why does BCRYPT_RNG_DUAL_EC_ALGORITHM get removed from CNG API on Windows 10?

On article at => Microsoft Docs CNG Algorithm Identifiers I notice that BCRYPT_RNG_DUAL_EC_ALGORITHM is now removed since Windows 10. Beginning with Windows ...
4 votes
1 answer
221 views

Can the backdoor in Dual_EC_DRBG be used to create a public key stream cipher?

Dual_EC_DRBG has the property that if $Q = e\cdot P$, someone who knows $e$ can break the PRNG. This seems to lead to a public-key stream cipher: Alice chooses a random $P, e$, where $P$ is a ...
7 votes
1 answer
1k views

Why does anyone use elliptic curves for a CSPRNG?

I saw Martijn Grooten's talk on elliptic curves at BSides London this year, and it helped me understand how elliptic curve crypto works, especially in the case of Diffie-Hellman (ECDH). He also ...
2 votes
2 answers
599 views

Is it possible to calculate the 'skeleton key' for DUAL_EC_DRBG? What would it take?

According to Bruce Schneier the constants used in the spec of DUAL_EC_DRBG may be related to a secret set of numbers, that could function as a master key for ...
1 vote
0 answers
224 views

Exploration of Blum Micali Security By Seed Size

I'm new to cryptography and am most intrigued by mathematically based pseudo random number generators. With reference to the Blum Micali algorithm: $X_{i+1} = G^{X_i} \bmod P$ can security be ...
10 votes
2 answers
4k views

Does Microsoft use Dual_EC_DRBG by default?

So, as we all know, Dual_EC_DRBG contains an NSA back door. At this point, there is no reason to call it a "potential" or even an "alleged" back door; the presence is obvious even to the NY Times. As ...
1 vote
0 answers
150 views

$\phi$ function in Dual_EC_DRBG

I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition ...
2 votes
1 answer
539 views

Dual_EC_DRBG and OpenSSL on a Mac

Since there is not much info anywhere on the Internet related to this: Does anyone know if OpenSSL's default CSPRNG is Dual_EC_DRBG or not? Their wiki is not very clear… Related to the first question,...