NSA compromised Dual EC DRBG never actually worked in OpenSSL(marc.info)
marc.info
NSA compromised Dual EC DRBG never actually worked in OpenSSL
http://marc.info/?l=openssl-announce&m=138747119822324&w=2&x=1
7 comments
While it's funny that Dual_EC_DRGB was so maligned, this bug was not found until the recent news, it's also disturbing that OpenSSL is so poorly tested that a bug of this magnitude was allowed to slip through for so long.
From my understanding, OpenSSL is well-tested, but not against the FIPS 140-2 validation (because it's not very meaningful), which is what would reveal this issue.
Like most open-source stuff, things that matter get eyes on it.
Like most open-source stuff, things that matter get eyes on it.
> Why wasn't this bug caught in the FIPS 140-2 validation testing?
>
> [snip explanation...]
Try to read the articles sometimes.
Try to read the articles sometimes.
FIPS 140-2 isn't the only testing done on OpenSSL. You'd think some unit tests would be in place at least.
Next in thread, David Johnson points out:
I have previously pointed this out as a bug in the FIPS spec. The need to prevent matching pairs in random numbers by 4.8.2 in FIPS 140-2 reduces the entropy.
The requirement in 4.8.2 applies to all SP800-90 DRBGs, not just the Dual EC DRBG.
I submitted this as part of my comments to the re-opened SP800-90 comment period.
I have previously pointed this out as a bug in the FIPS spec. The need to prevent matching pairs in random numbers by 4.8.2 in FIPS 140-2 reduces the entropy.
The requirement in 4.8.2 applies to all SP800-90 DRBGs, not just the Dual EC DRBG.
I submitted this as part of my comments to the re-opened SP800-90 comment period.
So they have a patch to fix it, but can't apply it because that would void the FIPS certification status, and they won't apply it because they are disabling the use of Dual_EC_DRBG anyway.