{"id":6522,"date":"2013-12-21T18:29:46","date_gmt":"2013-12-21T23:29:46","guid":{"rendered":"http:\/\/www.math.columbia.edu\/~woit\/wordpress\/?p=6522"},"modified":"2018-02-04T16:00:52","modified_gmt":"2018-02-04T21:00:52","slug":"trust-the-math-an-update","status":"publish","type":"post","link":"https:\/\/www.math.columbia.edu\/~woit\/wordpress\/?p=6522","title":{"rendered":"Trust the math? An Update"},"content":{"rendered":"

Back in September, I wrote here<\/a> about the news that Snowden’s revelations that confirmed suspicions that back in 2005-6 NSA mathematicians had compromised an NIST standard for elliptic-curve cryptography. The new standard was promoted as an improvement using sophisticated mathematical techniques, when these had really just been used to introduce a backdoor allowing the NSA to break encryption using this standard. There still does not seem to have been much discussion in the math community of the responsibility of mathematicians for this (although the AMS this month is running this opinion piece<\/a>).<\/p>\n

After my blog post, some nice detailed descriptions of how this was done and the mathematics involved appeared. See for instance The Many Flaws of Dual_EC_DRBG<\/a> by Matthew Green, and The NSA back door to NIST<\/a> by Thomas Hales. The Hales piece will appear soon in the AMS Notices. Hales also has a more recent piece, Formalizing NIST Standards<\/a>, which argues for the use of formal verification methods to check such standards. Also appearing after my blog post was the news<\/a> that RSA Security was now advising people not to use one of its products in default mode, the BSAFE toolkit.<\/p>\n

One mystery that remained was why the NIST had promulgated a defective standard, knowing full well that experts were suspicious of it. Also unclear was why RSA Security would include a suspicious standard in their products. Back in September they told people that (see here<\/a>) they had done this because:<\/p>\n

The hope was that elliptic curve techniques\u2014based as they are on number theory\u2014would not suffer many of the same weaknesses as other techniques<\/p><\/blockquote>\n

and issued a statement<\/a> saying:<\/p>\n

RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any backdoors in our products. Decisions about the features and functionality of RSA products are our own.<\/p><\/blockquote>\n

Today there are new revelations about this<\/a> (it’s unclear from what source), which explain what helped make RSA swallow the bogus mathematics: a payment from the NSA of \\$10 million. I guess there’s a lesson in this: when you can’t figure out why someone went along with a bad mathematical argument, maybe it’s because someone else gave them \\$10 million…
\n
\nUpdate<\/strong>: For another explanation of the math behind this, see videos here<\/a> and here<\/a> featuring Edward Frenkel.<\/p>\n

Update:<\/strong> There’s a response to the Reuters story from RSA here<\/a>. As I read it, it says <\/p>\n