IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Ex-NSA director: Support for insecure cryptography tool "regrettable"

The solution was riddled with backdoors but was pushed to businesses regardless

The NSA's former research director has apologised for the body's endorsement of an insecure cryptography solution that was adopted by American businesses.

The NSA's support for the Dual Elliptic Curve Deterministic Random Bit Generator (Dual EC DRBG) was a key factor in the US National Institute of Standards and Technology (NIST) approving the tool as a trustworthy solution throughout the 2000s, encouraging businesses to use the system.

It was integrated into RSA Security's BSAFE toolkits, alongside others'.

However, researchers have since found plenty of backdoors allowing hackers to siphon off and decrypt data, rendering the tool useless.

The NSA's former research director, Michael Wertheimer, wrote in a letter published by the American Mathematical Society: "With hindsight, the NSA should have ceased supporting the Dual EC DRBG algorithm immediately after security researchers discovered the potential for a trapdoor.

"In truth, I can think of no better way to describe our failure to drop support for the Dual EC DRBG algorithm as anything other than regrettable."

The flaw was exposed by former government contractor Edward Snowden in 2013 in leaked documents and as a result, NIST removed the tool from its approved list in 2014.

"The costs to the Defense Department to deploy a new algorithm were not an adequate reason to sustain our support for a questionable algorithm," Wertheimer continued.

"Indeed, we support NIST's April 2014 decision to remove the algorithm. Furthermore, we realise that our advocacy for the Dual EC DRBG casts suspicion on the broader body of work the NSA has done to promote secure standards."

To add more fuel to the fire, it later came to light that the NSA may have paid RSA $10m to integrate its security solution into the software, although neither the NSA nor RSA have officially confirmed this.

Wertheimer was the NSA's research director from May 2010 until September 2014, according to his LinkedIn profile.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

US gov issues fresh warning over Russian threat to critical infrastructure
cyber warfare

US gov issues fresh warning over Russian threat to critical infrastructure

12 Jan 2022

Most Popular

Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
Costa Rica declares state of emergency following Conti ransomware attack
ransomware

Costa Rica declares state of emergency following Conti ransomware attack

10 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022