RSA warns against use of DUAL_EC_DRBG

Categories: Blog, Encryption, Policy

RSA, an internet security firm, has warned customers against using the DUAL_EC_DRBG random number generation algorithm which they distributed with some of their products. The warning comes after the algorithm has been singled out as compromised by the NSA in the course of Project Bullrun. The problem is that the random numbers generated by the piece of code are actually not random in specific ways that make them vulnerable to exploitation by specific actors, which could lead to those actors obtaining the cryptographic keys of users.

Matthew Green,  a cryptography researcher at Johns Hopkins University, has published an excellent series of posts on the vulnerabilities of the algorithm and the issues around it on his blog.

Dan Gifford- MCySec Media Manager

Comments are closed.