<story><title>NSA infiltrated RSA security more deeply than thought: Study</title><url>http://www.reuters.com/article/2014/03/31/uk-usa-security-nsa-rsa-idUKBREA2U0U620140331</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>The extended_random_value extension is by itself innocuous; in fact, in its historical context (2008), it&amp;#x27;s just on the edge of plausibly beneficial.&lt;p&gt;All extended_random_value does is add, to the random_bytes value in the TLS handshake, another variable-length blob of random data. The ostensible idea behind the extension is that there are protocols that want randomness proportional to key sizes, and the 28 random bytes already in the handshake are insufficient.&lt;p&gt;That is &lt;i&gt;all&lt;/i&gt; the extension does. It doesn&amp;#x27;t influence your random number generator, it doesn&amp;#x27;t change the crypto algorithms in TLS.&lt;p&gt;Now, extended_random_value is &lt;i&gt;not&lt;/i&gt; innocuous in 2014. There&amp;#x27;s a very good chance that the PKRNGs (Dual_EC and the like) are intended as cryptographic backdoors, and modern sensibilities about crypto protocols dictate that both sides of a protocol should be careful about &amp;quot;showing all their cards&amp;quot; (as it were) when it comes to random number generators. It&amp;#x27;s now thought to be risky to disclose too much state.&lt;p&gt;But that was definitely not the attitude in place in the early 2000s --- more randomness was better.&lt;p&gt;Finally, it&amp;#x27;s worth knowing that nobody uses extended_random_value. Even fewer people were exposed to it than were exposed to Dual_EC (which very few apps were --- so few that, from what I can tell, nobody has ever named such an app on HN [companies using BSafe do not equate to apps using Dual_EC, much less exploitably]). Even the Internet Draft seems quizzical about why the extension would exist, and it more or less says &amp;quot;you&amp;#x27;d use this if your TLS needed to be compatible with the DoD&amp;quot;.&lt;p&gt;PS: It&amp;#x27;s been a few months since I looked, but interesting to note: the mailing list discussions about extended_random_value were also skeptical about the intention behind the extension. Rescorla more or less said (IIRC) &amp;quot;the USG asked me to specify this so they could use TLS&amp;quot;. Nobody on the TLS WG ever told an implementor that they should adopt this.†&lt;p&gt;PPS: Whatever &amp;#x27;pbsd says that conflicts with this comment, believe the &amp;#x27;pbsd comment, not mine. :)&lt;p&gt;† &lt;i&gt;I&amp;#x27;m a little wrong here; the mailing list discussion I&amp;#x27;m thinking of is about OpaquePRF. But OpaquePRF is basically the same concept, and by the same authors; extended_random_value is a refinement. Neither was standardized.&lt;/i&gt;</text></comment>
<story><title>NSA infiltrated RSA security more deeply than thought: Study</title><url>http://www.reuters.com/article/2014/03/31/uk-usa-security-nsa-rsa-idUKBREA2U0U620140331</url></story><parent_chain></parent_chain><comment><author>ig1</author><text>A far bigger issue is &amp;quot;The NSA played a significant role in the origins of Extended Random. The authors of the 2008 paper on the protocol were Margaret Salter, technical director of the NSA&amp;#x27;s defensive Information Assurance Directorate, and an outside expert named Eric Rescorla.&amp;quot;&lt;p&gt;Given Rescorla involvement with the TLS standard and Mozilla it&amp;#x27;s concerning that he declined to comment on this.</text></comment>