by Jeff Larson and Justin Elliott ProPublica, Sep. 13, 2013, 2:07 p.m.
NIST chief Patrick Gallagher (right) testifies before the Senate in June. NSA director Keith Alexander is on the left. (AP/J. Scott Applewhite)
But in a little-noticed footnote, NIST went a step further, saying it is “strongly” recommending against even using one of the standards. The institute sets standards for everything from the time to weights to computer security that are used by the government and widely adopted by industry.
As ProPublica, the New York Times, and the Guardian reported last week, documents provided by Edward Snowden suggest that the NSA has heavily influenced the standard, which has been used around the world.
In its statement Tuesday, NIST acknowledged that the NSA participates in creating cryptography standards “because of its recognized expertise” and because NIST is required by law to consult with the spy agency.
“We are not deliberately, knowingly, working to undermine or weaken encryption,” NIST chief Patrick Gallagher said at a public conference Tuesday.
Various versions of Microsoft Windows, including those used in tablets and smartphones, contain implementations of the standard, though the NSA-influenced portion isn’t enabled by default. Developers creating applications for the platform must choose to enable it.
The New York Times noted earlier this week that documents provided by Snowden show the spy agency played a crucial role in writing the standard that NIST is now cautioning against using, which was first published in 2006.
The NIST standard describes what is known as an “elliptic curve-based deterministic random bit generator.” This bit of computer code is one way to produce random numbers that are the cornerstone of encryption technology used on the Internet. If the numbers generated are not random but in fact predictable, the encryption can be more easily cracked.
The Times reported that the Snowden documents suggest the NSA was involved in creating the number generator.
Researchers say the evidence of NSA influence raises questions about whether any of the standards developed by NIST can be trusted.
“NIST’s decisions used to be opaque and frustrating,” said Matthew Green, a professor at Johns Hopkins University. “Now they’re opaque and potentially malicious. Which is too bad because NIST performs such a useful service.”
Cryptographers have long suspected the standard in question was faulty. Seven years ago, a pair of researchers in the Netherlands authored a paper that said the random number generator was insecure and that attacks against it could “be run on an ordinary PC.” A year after that, in 2007, two Microsoft engineers flagged the standard as potentially containing a backdoor.
Following the criticism, the standard was revised in 2007 to include an optional workaround.
The NSA has long been involved in encryption matters at the standards institute.
“NIST follows NSA’s lead in developing certain cryptographic standards,” a 1993 Government Accountability Office report noted.
A 2002 law mandates that NIST set information security standards and lists the NSA merely as one of several other agencies that must be consulted.
Asked how often standards are reopened, NIST spokesperson Gail Porter, said, “It’s not frequent, but it does happen.” She added that it would be “difficult to give you an exact number of times.”
Asked whether Microsoft would continue to use the encryption standard in some of its software, a spokesperson said the company “is evaluating NIST’s recent recommendations and as always, will take the appropriate action to protect our customers.”
The NSA declined to comment.
