Skip to main content

Questions tagged [nsa]

The National Security Agency (NSA) is the central producer and manager of signals intelligence for the United States Government.

Filter by
Sorted by
Tagged with
162 votes
4 answers
54k views

Should we trust the NIST-recommended ECC parameters?

Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
D.W.'s user avatar
  • 36.5k
52 votes
6 answers
18k views

Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
D.W.'s user avatar
  • 36.5k
46 votes
7 answers
11k views

How can we reason about the cryptographic capabilities of code-breaking agencies like the NSA or GCHQ?

I have read in Applied Cryptography that the NSA is the largest hardware buyer and the largest mathematician employer in the world. How can we reason about the symmetric ciphers cryptanalysis ...
jokoon's user avatar
  • 713
39 votes
1 answer
31k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
DeepSpace101's user avatar
  • 1,717
27 votes
5 answers
7k views

Could RDRAND (Intel) compromise entropy?

I was recently discussing the issue of RDRAND in Intel chips and the whole issue about how NSA could potentially be influencing Intel to weaken or create backdoors in their design. This petition was ...
Michael Aquilina's user avatar
27 votes
3 answers
26k views

Why is the P-521 elliptic curve not in Suite B if AES-256 is?

In the NSA's document, "The Case for Elliptic Curve Cryptography" (archived), we have ...
DeepSpace101's user avatar
  • 1,717
26 votes
3 answers
5k views

How Far Ahead of Academia Are Government Agencies? [closed]

This is a soft question regarding comparisons between government security services (eg, NSA or GCHQ) and open-source research (e.g., academia). Hopefully it's on-topic for this site! In essence, my ...
Sam OT's user avatar
  • 448
17 votes
1 answer
1k views

What NIST protocol was allegedly backdoored by NSA in 2006?

From a recent NY Times article: Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology ...
Fixee's user avatar
  • 4,168
10 votes
2 answers
4k views

Does Microsoft use Dual_EC_DRBG by default?

So, as we all know, Dual_EC_DRBG contains an NSA back door. At this point, there is no reason to call it a "potential" or even an "alleged" back door; the presence is obvious even to the NY Times. As ...
Nemo's user avatar
  • 1,377
9 votes
1 answer
1k views

Why does BCRYPT_RNG_DUAL_EC_ALGORITHM get removed from CNG API on Windows 10?

On article at => Microsoft Docs CNG Algorithm Identifiers I notice that BCRYPT_RNG_DUAL_EC_ALGORITHM is now removed since Windows 10. Beginning with Windows ...
sandthorn's user avatar
  • 193
9 votes
1 answer
231 views

What was the NSA's reasoning for making their bitwise combination functions in SHA-1 the way they did?

I know that these functions are there to actually make the program work. What I want to know is why they made the functions one way but not another. For example, why did they pick F1(B, C, D) = (B &...
BonBon's user avatar
  • 101
9 votes
1 answer
814 views

What does NSA mean by 'Analyzable'?

Recently NSA published two new algorithms, Simon and Speck. In the abstract they say The aim of SIMON and SPECK is to fill the need for secure, flexible, and analyzable lightweight block ciphers. ...
rath's user avatar
  • 2,558
9 votes
1 answer
2k views

NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?

Recently, the NSA (re-published?) their CNSA guidelines and some information on post-quantum computers (per the title of the document). Here's the link for convenience (document is titled, 'Quantum ...
librehash's user avatar
  • 145
8 votes
1 answer
1k views

Who originally generated the elliptic curve now known as P256/secp256r1

Background: there is a theory going around that claims that P256 was backdoored by the NSA. The theory goes is that the NSA found a weakness that applies to a nontrivial fraction of elliptic curves (...
poncho's user avatar
  • 148k
8 votes
1 answer
2k views

What are the relations between cryptanalysis of block ciphers such as AES and Kendall's tau coefficient?

Studying AES on Wikipedia, I noticed a statement regarding some ongoing studies on the use of Kendall's Tau coefficient in cryptanalysis: According to the Snowden documents, the NSA is doing ...
Darumaseye's user avatar
7 votes
1 answer
890 views

What could "look for the constants that you might find in RC6" mean?

In this presentation at the 30c3 (long but extremely interesting and well-documented), Jacob Appelbaum gave this verbal advice (circa 43'30"): look for the constants that you might find in RC6 I'm ...
fgrieu's user avatar
  • 142k
6 votes
2 answers
439 views

Fast post-processing for broken RDRAND

Let's assume that the Intel RDRAND instruction does not return fully random numbers, e.g. because it has been engineered with a backdoor for the NSA. If the Intel RDRAND instruction is used directly ...
Maarten Bodewes's user avatar
  • 93.2k
5 votes
1 answer
740 views

Security of RSA-3072 with public exponent $2^{16}+1$

NSA recommendation for the pre-quantum period allows the use of RSA-3072 (https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm), nevertheless, is it safe enough to do it with the ...
Evgeni Vaknin's user avatar
5 votes
1 answer
237 views

State level "Weak Diffie-Hellman" working for SRP too?

I've read about the "Weak Diffie-Hellman" attack (paper, website), where a resourceful entity like a state can pre-compute values for known primes to aid solving the discrete logarithm ...
user10008's user avatar
  • 153
5 votes
1 answer
498 views

Aside from DES, has the NSA ever strengthened algorithms?

When DES was originally developed, the NSA changed the s-boxes. For decades, people thought that their changes introduced a backdoor, but then it was discovered that their changes actually ...
neubert's user avatar
  • 2,939
5 votes
1 answer
4k views

Who uses the RSA BSAFE library? [duplicate]

Who uses RSA's BSAFE library? Does anyone know what products use it, or have any statistics on how many end users use something that is built on BSAFE? Background: BSAFE is one of the oldest ...
D.W.'s user avatar
  • 36.5k
3 votes
3 answers
2k views

Why did the NSA create SHA?

New to cryptography, I'm trying to learn the program Veracrypt, and I'm now trying to understand the history of hash functions and how it applies to Veracrypt. So this is what I understand so far, the ...
How_To _Privacy's user avatar
3 votes
0 answers
164 views

What are the concrete changes the NSA did to the algorithm before DES was published?

It's common knowledge that the NSA, before publication of DES, tweaked the algorithm to improve its resistance against differential cryptanalysis. Schneier writes some of this on his blog, for example ...
performancematters's user avatar
2 votes
1 answer
926 views

Hide a weakness in ECC by choosing the prime or one of the curve coefficients

Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve $$E: y^2 \equiv x^3 -3x + b \pmod p$$ is cryptographically weak? You need to choose $p,b$...
D.W.'s user avatar
  • 36.5k
2 votes
2 answers
1k views

Keyless integrity checking with SHA-256

Currently a program is loading some files from an untrustworthy source (e.g. a CDN) which could have been tampered with. It has a known SHA-256 hash of the file stored locally, then it downloads the ...
Hans's user avatar
  • 21
2 votes
1 answer
3k views

RSA vs ECDSA/ECDH

So we've been using RSA for a while now. I wonder, is it still secure? I'm wondering whether surveillance agencies can at this point read traffic encrypted with say, TLS_ECDH_RSA_WITH_AES_128_GCM? ...
Jasper Weiss's user avatar
2 votes
2 answers
610 views

Is it possible to calculate the 'skeleton key' for DUAL_EC_DRBG? What would it take?

According to Bruce Schneier the constants used in the spec of DUAL_EC_DRBG may be related to a secret set of numbers, that could function as a master key for ...
oɔɯǝɹ's user avatar
  • 123
2 votes
2 answers
389 views

Solid summary of what encryption remains strong after recent events [closed]

Following the recent government hacking (and subsequent news and fallout), I'm wondering what crypto-systems remain strong (and why) and what crypto-systems were exploited too heavily to be reliable. ...
stackuser's user avatar
  • 583
2 votes
0 answers
69 views

If Kerckhoffs's principle is correct why does the NSA not publish their Suite A ciphers? [duplicate]

The Wikipedia article offers little insight. To quote the page: the decision to keep them secret is in keeping with a layered security posture How should we (the cryptographic community) ...
PrimePower's user avatar
2 votes
0 answers
319 views

PGP encryption options

I recently began using PGP desktop and found several options for my encryption capabilities. Firstly, which of these (AES, CAST, Triple DES, TwoFish, IDEA) is the most recent? Secondly, may the NSA ...
Not Free Anymore I see's user avatar
1 vote
2 answers
690 views

HMAC-Ripemd-160 in TrueCrypt

I'm wondering if it is still secure. I know TrueCrypt closed its doors but I continue using it because the cryptoaudit didn't find any huge bugs or security issues in TrueCrypt. But I have a bad ...
user284148's user avatar
1 vote
0 answers
138 views

What’s the relationship between P-256 and Dual EC DRBG?

It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it. With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
Eduardo Andrés Castillo Perera's user avatar
0 votes
1 answer
1k views

Cryptographic algorithms compromised and alternatives?

After Edward Snowden's release of top secret information we have seen clues that the NIST certified crypto-algorithms like AES might be compromised. Although not as fast as AES, we prefer Twofish ...
NetCoder's user avatar
0 votes
1 answer
226 views

What is required to use a cryptographic algorithm backdoor?

David Wong in his book Real-World Cryptography writes: In 2013, following revelations from Edward Snowden, it was discovered that NSA had purposefully and successfully pushed for the inclusion of ...
Andrew Savinykh's user avatar
0 votes
1 answer
349 views

What is the difference between exhaustive search and factorization in relationship to determining a key?

It seems to me an exhaustive search would simply try to use all the possible bit combinations of a key, while factorization is some mathematical formula for determining the key? When discussing the ...
user avatar
-2 votes
1 answer
261 views

I can divide a very large integer - did I discover anything?

So I was sitting on an algorithm I thought up at school, and just decided to implement it. And it worked for what I wanted - but I don't know what this is worth. I broke apart a 2048 private key for ...
jackhammer's user avatar
-4 votes
1 answer
103 views

Is it true that AES initialization constants, which are supposed to be random numbers, were in fact chosen by the NSA?

Is it true that AES initialization constants, which are supposed to be random numbers, were in fact chosen by the NSA? I mean, it's said it was done before algorithm standardization when it was still ...
nimrodel's user avatar