RSA denies entering into NSA agreement to use flawed algorithm

Share this article:

RSA, the security division of EMC, has quickly denied allegations it used a flawed encryption formula in its products after entering into a $10 million secret contract with the National Security Agency (NSA). 

A Friday article published by Reuters refers to leaked documents, which reveal that the contract set an “NSA formula as the preferred, or default, method for number generation in the BSAFE software.”

All versions of RSA's BSAFE toolkits were revealed in September to be impacted by a community-developed encryption algorithm believed to contain an NSA backdoor.

At the time, RSA and the National Institute of Standards and Technology (NIST) recommended not using the flawed algorithm, known as Dual Elliptic Curve Deterministic Random Bit Generator (Dual EC DRBG).

“We continued using the algorithm as an option within BSAFE toolkits as it gained acceptance as a NIST standard and because of its value in FIPS compliance,” according to an RSA statement. “When concern surfaced around the algorithm in 2007, we continued to rely upon NIST as the arbiter of that discussion.”

The release continues, “When NIST issued new guidance recommending no further use of this algorithm in September 2013, we adhered to that guidance, communicated that recommendation to customers and discussed the change openly in the media.”

Dual EC DRBG is one of many algorithms available in BSAFE toolkits, according to the RSA statement, which adds that users are free to choose whichever one works best for them.

Share this article:

Sign up to our newsletters

More in News

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.

Report: DDoS up in Q4 2013, vulnerability scanners leveraged to exploit sites

Report: DDoS up in Q4 2013, vulnerability scanners ...

Researchers observed 346 DDoS attacks in the final quarter of 2013 and attackers used Vega and Skipfish vulnerability scanners to exploit web flaws at financial companies.