Dual_EC_DRBG is not really a NIST standard ( Update: John Kelsey confirms this.) It would be curious to know how widely this information was shared, and whether anyone on the committee ever inquired as to the provenance of the default parameters. What this patent demonstrates is that some members of the ANSI committee, of which RSA was also a member, had reason to at least suspect that Dual EC could be used to create a wiretapping backdoor. In fact, the generator appears to be an NSA invention, and may date back to the early 2000s.

The existence of this patent does not mean that Brown and Vanstone were responsible for Dual EC. Indeed, it may be due to Brown and Vanstone that the NIST standard includes an alternative method to close the backdoor (by generating a random Q point). The patent also describes a number of ways to close the backdoor in Dual_EC_DRBG. In this case, trusted law enforcement agents may need to decrypt encrypted traffic of criminals, and to do this they may want to be able to use an escrow key to recover an encryption key.įor example, in the SSL and TLS protocols, which are used for securing web (HTTP) traffic, a client and server perform a handshake in which their first actions are to exchange random values sent in the clear. Escrow keys can provide other functionality, such as for use in a wiretap.

Therefore, if the ECRNG is used to generate the encryption key K, then it may be possible that the escrow key e can be used to recover the encryption key K. However, encryption keys are generally the output of random number generators. If a cryptographic key is lost, then data encrypted under that key is also lost. The administrator will have an escrow key for every ECRNG that follows that standard.Įscrow keys are known to have advantages in some contexts. If P and Q are established in a security domain controlled by an administrator, and the entity who generates Q for the domain does so with knowledge of e (or indirectly via knowledge of d). The application claims a priority date of January 2005. This surprising news comes via a patent application filed by Certicom employees Dan Brown and Scott Vanstone. In point of fact, the possibility of a backdoor was known to at least some members of the ANSI X9.82 standardization committee as far back in January 2005.

Dan brown nsa