NSA contracted RSA to use flawed algorithm, leaks reveal

Share this article:
A secret contract reportedly tied the NSA and security firm RSA.
A secret contract reportedly tied the NSA and security firm RSA.

Leaked classified documents, detailed in a Friday Reuters article, show that the National Security Agency (NSA) arranged a $10 million deal with RSA that ultimately led to the security firm using a “flawed” encryption formula in its products.

According to Reuters, the contract set an “NSA formula as the preferred, or default, method for number generation in the BSAFE software.”

It was revealed in September that all versions of RSA's BSAFE Toolkits were impacted by a community-developed encryption algorithm that was believed to contain an NSA backdoor.

The algorithm in question was Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG), which both RSA and the National Institute of Standards and Technology (NIST) recommended the industry not use at the time.

Reuters reported that while the $10 million deal “might seem paltry” for a major company such as RSA – which serves as the security division for the global data storage corporation EMC – it actually accounted for “more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year."

Dual_EC_DRBG was adopted by RSA before NIST's approval, and to help spur NIST's endorsement of its use, NSA shared that the government had already used the algorithm for some time, Reuters revealed.

“RSA's contract made Dual Elliptic Curve the default option for producing random numbers in the RSA toolkit,” the article said. “No alarms were raised, former [RSA] employees said, because the deal was handled by business leaders rather than pure technologists.”

Share this article:

Sign up to our newsletters

More in News

Research shows vulnerabilities go unfixed longer in ASP

Research shows vulnerabilities go unfixed longer in ASP

A new report finds little difference in the number of vulnerabilities among programming languages, but remediation times vary widely.

Bill would restrict Calif. retailers from storing certain payment data

The bill would ban businesses from storing sensitive payment data, for any long than required, even if it is encrypted.

Amplification, reflection DDoS attacks increase 35 percent in Q1 2014

Amplification, reflection DDoS attacks increase 35 percent in ...

The Q1 2014 Global DDoS Attack Report reveals that amplification and reflection distributed denial-of-service attacks are on the rise.