Dual_EC_DRBG Kleptographic Backdoor
NSA-designed backdoor in NIST SP 800-90A Elliptic Curve PRNG
Incident Overview
Dual_EC_DRBG was a standardized pseudorandom number generator promoted by NIST and NSA. Edward Snowden documents confirmed in 2013 that the NSA engineered a backdoor using secret elliptic curve relationships.
Real-World Impact
Enabled silent decryption of TLS connections, IPsec VPN tunnels, and encrypted sessions using RSA Security BSAFE toolkit.
Technical Root Cause Analysis
Elliptic curve generator points P and Q were chosen such that Q = d * P, where secret scalar d was known exclusively to NSA cryptanalysts.
- Kleptographic Relation: Point Q on P-256 curve was generated using secret scalar d: Q = d * P.
- State Recovery: An observer knowing d and 32 bytes of PRNG output could calculate internal state `s` via `s = d * x_point`, predicting all future encryption keys.
Dual_EC_DRBG Backdoor Mechanism
# Attacker knows secret scalar 'e' such that P = e * Q
# Given output point R = s * Q:
# Attacker computes e * R = e * (s * Q) = s * (e * Q) = s * P
# Reconstructs internal state 's' instantly!Incident Timeline
Dual_EC_DRBG submitted to NIST SP 800-90A standard.
Shumow & Ferguson present theoretical backdoor at Crypto 2007.
Snowden leaks confirm NSA paid RSA Security $10M to default to Dual_EC_DRBG in BSAFE.
NIST formally revokes Dual_EC_DRBG from SP 800-90A standard.
Key Engineering Takeaway & Defensive Guidance
Standardization processes must require provably rigid, non-arbitrary domain parameters (e.g. "nothing-up-my-sleeve" numbers).