Dual_EC_DRBG or Dual Elliptic Curve Deterministic Random Bit Generator^[1] is a controversial pseudorandom number generator (PRNG) designed and published by the National Security Agency. It is based on the elliptic curve discrete logarithm problem (ECDLP) and is one of the four PRNGs standardized in the NIST Special Publication 800-90. Shortly after the NIST publication, it was suggested that the RNG could be a kleptographic NSA backdoor.^[2]

Security [edit]

The stated purpose of including the Dual_EC_DRBG in NIST SP 800-90 is that its security is based on a hard problem from number theory, such as the elliptic curve Decision Diffie-Hellman problem. Given the importance of having secure random number generators in cryptography, in certain cases it may be desirable to sacrifice speed for security.

Subsequent to publication of the Dual_EC_DRBG algorithm, various researchers have reported certain security issues with the properties of the Dual_EC_DRBG:

• The intermediate values it generates, a sequence of elliptic curve points, should, under certain reasonable assumptions, such as the Decision Diffie-Hellman problem, be indistinguishable from uniformly random elliptic curve points.^[3][4][5]

• The sequence of bits generated from the Dual_EC_DRBG, under certain parameter choices, can be distinguished from uniformly random bits, making its output unsuitable for use as a stream cipher, and, arguably, for more general use.^[3][5][6]

• Its security requires that a certain problem be hard, such as the computational Diffie-Hellman problem, but one of the recommended configurations of the Dual_EC_DRBG permits the possibility that a key, which facilitates solution of the problem, has been retained. See the Controversy section for more discussion.

Controversy [edit]

This PRNG has been controversial because it was published in the NIST standard despite being three orders of magnitude slower than the other three standardized algorithms, and containing several weaknesses which have been identified since its standardization.^[2]

In August 2007, Dan Shumow and Niels Ferguson discovered that the algorithm has a vulnerability which could be used as a backdoor. Given the wide applications of PRNGs in cryptography, this vulnerability could be used to defeat practically any cryptosystem relying on it. The algorithm uses several constants which determine the output; it is possible that these constants are deliberately crafted in a way that allows the designer to predict its output.^[2][7]

This is an asymmetric backdoor as defined in cryptovirology that uses public-key encryption: the designer of the algorithm generates a keypair consisting of the public and private key; the public key is published as the algorithm's constants, while the private key is kept secret. It employs the discrete-log kleptogram introduced in Crypto 1997.^[8] Whenever the algorithm is being used, the holder of the private key can decrypt its output, revealing the state of the PRNG, and thereby allowing him to predict any future output. Yet for third parties, there is no way to detect the existence of the private key (nor to prove the non-existence of any such key). However, Appendix A.2 of the NIST document, which describes the weakness, does contain a method of generating a new keypair which will repair the backdoor if it exists.

See also [edit]

• Cryptographically secure pseudorandom number generator
• Nothing up my sleeve number
• Random number generator attack

References [edit]

External links [edit]

• Controversial random number generator in Vista Service Pack 1