The National Institute of Standards and Technology needs to hire more cryptographers and improve its collaboration with the industry and academia, reducing its reliance on the U.S. National Security Agency for decisions around cryptographic standards.
Lack of internal expertise in certain areas of cryptography and too much trust in the NSA led NIST to ignore security concerns about a pseudorandom number generator called Dual_EC_DRBG (Dual Elliptic Curve Deterministic Random Bit Generator) in 2006, technical experts who reviewed the organization’s standards development process said in a report released Monday.
Media reports last year based on secret documents leaked by former NSA contractor Edward Snowden claimed that the NSA used its influence over NIST to insert a backdoor into Dual_EC_DRBG and possibly weaken other cryptographic standards. The revelations called into question the integrity of NIST’s standard-making processes and damaged the organization’s reputation in the cryptographic community.
The new report by NIST’s Visiting Committee on Advanced Technology (VCAT) is based on assessments by a panel of outside technical experts including Internet pioneer Vint Cerf, who is vice president and chief evangelist at Google; cryptographer and Massachusetts Institute of Technology professor Ron Rivest, who co-authored the widely used RSA encryption algorithm; Edward Felten, professor and director of the Center for Information Technology Policy at Princeton University; Ellen Richey, executive vice president and chief enterprise risk officer at Visa; Steve Lipner, partner director of software security at Microsoft; Belgian cryptographer and cryptanalyst Bart Preneel, who works as a professor at the University of Leuven; and Fran Schrotter, senior vice president and chief operating officer of the American National Standards Institute.
Regarding the inclusion of Dual_EC in its SP 800-90A recommendation, “NIST failed to exercise independent judgment but instead deferred extensively to NSA,” Felten wrote in his assessment. “After DUAL_EC was proposed, two major red flags emerged. Either one should have caused NIST to remove DUAL_EC from the standard, but in both cases NIST deferred to NSA requests to keep DUAL_EC.”
NIST’s limited staffing and their lack of experience with elliptic curves, mathematical constructs that have important applications in cryptography and are used in DUAL_EC, were important factors that contributed to NIST’s mistakes, according to Felten.
“Internally, NIST has very limited cryptographic expertise: just a handful of cryptographers,” Rivest also wrote in his assessment. “The internal capabilities at NIST to develop and evaluate cryptographic standards is by itself not sufficient to produce the desired cryptographic standards, particularly given the number of standards and guidelines involved. Additional expertise is essential.”
While Dual_EC is the most obvious candidate for a standard intentionally weakened by the NSA, suspicion lingers over all NIST standards that the NSA played a significant role in developing.
The panel of experts also looked at two other issues: NIST’s decision to recommend NSA-chosen elliptic curves for ECDSA (Elliptic Curve Digital Signature Algorithm) in the FIPS 186 (Digital Signature Standard), and the recommendation of certain NSA-designed cipher modes for specific uses in the SP 800-38 series (Recommendation for Block Cipher Modes of Operation), despite evidence of security weaknesses.
The damage caused by a Dual_EC_DRBG backdoor may be small because few users may have actually used the pseudorandom number generator, Rivest said. However, “the damage to NIST and its credibility for developing trustworthy cryptographic standards is considerable. Not only do other NIST standards developed in coordination with the NSA now need critical review, but the process for developing future standards needs re-assessment and reformulation.”
“NIST may seek the advice of the NSA on cryptographic matters but it must be in a position to assess it and reject it when warranted,” VCAT said in its report. “This may be accomplished by NIST itself or by engaging the cryptographic community during the development and review of any particular standard.”