Dual_EC_DRBG

Dual_EC_DRBG or Dual Elliptic Curve Deterministic Random Bit Generator^[1] is a controversial pseudorandom number generator (PRNG) designed and published by the National Security Agency. It is based on the elliptic curve discrete logarithm problem (ECDLP) and is one of the four PRNGs standardized in the NIST Special Publication 800-90. Shortly after the NIST publication, it was suggested that the RNG could be a kleptographic NSA backdoor.^[2]

Security

This stated purpose of including the Dual_EC_DRBG in NIST SP 800-90 is that its security is based on a hard problem from number theory, such as the elliptic curve Decision Diffie-Hellman problem. Given the importance of having secure random number generators in cryptography, in certain cases it may be desirable to sacrifice speed for security.

Subsequent to publication of the Dual_EC_DRBG algorithm, various researchers have reported certain security issues with the properties of the Dual_EC_DRBG:

• The intermediate values it generates, a sequence of elliptic curve points, should, under certain reasonable assumptions, such as the Decision Diffie-Hellman problem, be indistinguishable from uniformly random elliptic curve points.^[3][4][5]

• The sequence of bits generated from the Dual_EC_DRBG, under certain parameter choices, can be distinguished from uniformly random bits, making its output unsuitable for use as a stream cipher, and, arguably, for more general use.^[3][5][6]

• Its security requires that a certain problem be hard, such as the computational Diffie-Hellman problem, but one of the recommended configurations of the Dual_EC_DRBG permits the possibility that a key, which facilitates solution of the problem, has been retained. See the Controversy section for more discussion.

Controversy

This PRNG has been controversial because it was published in the NIST standard despite being three orders of magnitude slower than the other three standardized algorithms, and containing several weaknesses which have been identified since its standardization.^[2]

In August 2007, Dan Shumow and Niels Ferguson discovered that the algorithm has a vulnerability which could be used as a backdoor. Given the wide applications of PRNGs in cryptography, this vulnerability could be used to defeat practically any cryptosystem relying on it. The algorithm uses several constants which determine the output; it is possible that these constants are deliberately crafted in a way that allows the designer to predict its output.^[2][7]

This backdoor would work analogously to public-key encryption: the designer of the algorithm generates a keypair consisting of the public and private key; the public key is published as the algorithm's constants, while the private key is kept secret. Whenever the algorithm is being used, the holder of the private key can decrypt its output, revealing the state of the PRNG, and thereby allowing him to predict any future output. Yet for third parties, there is no way to prove the existence (or non-existence) of the private key. However, Appendix A.2 of the NIST document, which describes the weakness, does contain a method of generating a new keypair which will repair the backdoor if it exists.

See also

• Cryptographically secure pseudorandom number generator
• Nothing up my sleeve number
• Random number generator attack

References

1. ^ (PDF) Recommendations for Random Number Generation Using Deterministic Random Bit Generators (Revised). National Institute of Standards and Technology. 2007-03. NIST SP 800-90. http://csrc.nist.gov/publications/nistpubs/800-90/SP800-90revised_March2007.pdf. 
2. ^ ^{a b c} Bruce Schneier (2007-11-15). "Did NSA Put a Secret Backdoor in New Encryption Standard?". Wired News. http://www.wired.com/politics/security/commentary/securitymatters/2007/11/securitymatters_1115. 
3. ^ ^{a b} Kristian Gjøsteen. Comments on Dual-EC-DRBG/NIST SP 800-90
4. ^ Daniel R. L. Brown (2006). Conjectured Security of the ANSI-NIST Elliptic Curve RNG. http://eprint.iacr.org/2006/117. 
5. ^ ^{a b} Daniel R. L. Brown and Kristian Gjøsteen. A Security Analysis of the NIST SP 800-90 Elliptic Curve Random Number Generator, CRYPTO 2007, LNCS 4622, Springer, pp. 466-481. IACR ePrint version
6. ^ Berry Schoenmakers and Andrey Sidorenko. Cryptanalysis of the Dual Elliptic Curve Pseudorandom Generator, IACR ePrint 2006/190.
7. ^ Dan Shumow, Niels Ferguson (2007-08). "On the Possibility of a Back Door in the NIST SP800-90 Dual Ec Prng" (PDF). CRYPTO Rump Session 2007. Microsoft. http://rump2007.cr.yp.to/15-shumow.pdf. 

External links

• Controversial random number generator in Vista Service Pack 1