Talk:Dual EC DRBG

message: Bruce Schneier says (http://www.schneier.com/blog/archives/2007/11/the_strange_sto.html) that Dual EC DRBG is three orders of magnitude, not three times, slower than its peers. Peter 16:14, 15 November 2007 (UTC)
replies: text: Fixed. -- intgr [talk] 17:12, 15 November 2007 (UTC)
thread_title: Slowness

message: The following information is missing from the article:
* When was this PRNG standardized? (The document in reference 1 is from march 2007, but it is titled "(revised)".
* How does it actually work?
-- Paul Ebermann (talk) 15:21, 12 September 2011 (UTC)
replies: text: I would like to try and describe the algorithm. I've already added a high-level overview. However I'm not sure how useful it's gonna be. Understanding the algorithm requires some completely different prerequisites than the rest of the article. Dlesos (talk) 13:26, 18 January 2022 (UTC)
thread_title:  Missing information 

message: The article currently says that DUAL_EC_DRBG has a fatal weakness which was engineered by the NSA, but that seems to be speculation. The NYT article provided as a citation does not identify the algorithm. Here is the full quote:
Simultaneously, the N.S.A. has been deliberately weakening the international encryption standards adopted by developers. One goal in the agency’s 2013 budget request was to “influence policies, standards and specifications for commercial public key technologies,” the most common encryption method.
Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology, the United States’ encryption standards body, and later by the International Organization for Standardization, which has 163 countries as members.
Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort “a challenge in finesse.”
“Eventually, N.S.A. became the sole editor,” the memo says.
Bruce Schneier has speculated (see here also) that DUAL_EC_DRBG is the algorithm in question, but if that's the best we have we should a) cite it and b) state that it is speculation.
 – mike@enwiki:~$  22:45, 5 September 2013 (UTC)
replies: text: Looks like we have actual confirmation.  – mike@enwiki:~$  17:06, 11 September 2013 (UTC)
replies: text: Confirmation of what?  Can you quote the material that indicates to you a confirmation?--Brian Dell (talk) 19:42, 13 January 2014 (UTC)
replies: text: About half a year ago someone at work showed me the backdoor. I did the maths, and in my words, it's so ingenious, it's provably impossible to detect this backdoor given just the algorithm description and key parameters, with less effort than breaking the cipher. The parameters have a mathematical relation that can only be found when you know the 'backdoor math'. --217.122.174.9 (talk) 20:42, 12 March 2016 (UTC)
thread_title:  "Fatal weakness" engineered by NSA? 

message: The statement in the lede is misleading:  I can find no publication of the algorithm by the NSA in advance of the NIST SP800 publication.  Can anyone cite such a reference?  Ross Fraser (talk) 13:34, 23 September 2013 (UTC)
replies: text: The current lede does not say that NSA published the standard? Thue (talk) 13:40, 23 September 2013 (UTC)
thread_title:  Published by the NSA? 

message: Their statement to Ars is so clearly misleading, that anyone who knows anything about the subject can easily see it. Slow random number generator to thwart attacks? Gimmi a break, this is not how things are done. Wikipedia shouldn't reproduce it without clearly explaining it's nature, as people that does not understand the issues involved might be easily misled by this PR/damage control statement from RSA.
jk 22:14, 26 September 2013 (GMT+1)
:Agreed 100%. "Dual_EC_DRBG was an accepted and publicly scrutinized standard" - yeah, and the scrutiny had clearly concluded it was inferior and possibly had a backdoor. I am surprised RSA can't find anybody to spin less obvious bullshit. I will change it if nobody else will, using the section I write at Rsa_security#NSA_backdoor as a template. Thue (talk) 22:03, 26 September 2013 (UTC)
replies: text: The wording is too argumentative. We can only include what reliable sources say, not our own opinions. I've trimmed out unsourced opinion.--agr (talk) 23:04, 15 October 2013 (UTC)
thread_title:  Don't be a mouthpiece for RSA 

message: The text "one of the recommended configurations of the Dual_EC_DRBG permits the possibility of the existence of a known secret key, which facilitates solution of the problem, has been retained" doesn't parse.  Was is supposed to be something like "... permits the possibly that a known secret key ... has been retained"?
2620:0:1000:1501:1260:4BFF:FE68:1974 (talk) 16:48, 3 October 2013 (UTC)
thread_title:  Wording problem 

message: I disagree with the recent article rename, from Dual EC DRBG (Google: 151,000 results) to Dual elliptic curve deterministic random bit generator (Google: 14,500). Note that even Dual_EC_DRBG gets 73,000 Google hits. (All searches with quote marks)
The expansion is way too long and I'd argue it violates WP:COMMONNAME. The subject is most well known due to having a backdoor, it doesn't really matter what technology it's based on. Even the original standard almost exclusively refers to it as "Dual_EC_DRBG", only once does it say "Dual Elliptic Curve Deterministic RBG" -- in the section title.  -- intgr [talk] 22:16, 23 December 2013 (UTC)
replies: text: I renamed the article because the previous title was an uninformative initialism - the general reader cannot work out what the article is about from the title. Google hits are not a good way to assess proper article names. WP:COMMONNAME calls for article titles to be recognisable and states 'Ambiguous [...] names for the article subject [...] are often avoided even though they may be more frequently used by reliable sources'. Whilst not strictly speaking ambiguous, 'Duel EC DRBG' gives very little information on what the article is about, whilst 'Dual elliptic curve deterministic random bit generator' at least gives the reader the information that this is a random number generator that uses elliptic curves. See also WP:CONCISE which requires article titles to contain 'sufficient information to identify the topic in a way the average person searching for it will recognize'. I think the new name is clearer, more informative, and not overly verbose. Having said that, I moved the page boldy and would no objection to moving back if consensus on this talk page is against me. Modest Genius talk 14:48, 24 December 2013 (UTC)
replies: text: I notice that the article has been moved back to the initialism. I agree with that. The previous spelled out title can refer to a whole class of RNGs with different elliptic curves. Dual_EC_DRBG refers to an instance of the overall concept using specific elliptic curve generated by NSA and approved by NIST. It is the provenance of that curve, and the possibility that it could have been generated with a back door, that is at the heart of the controversy. --agr (talk) 17:07, 29 December 2013 (UTC)
thread_title:  Revert article rename? 

message: We need a list of products, operating systems, appliances that use this algorithm.
Is MS Windows using it? MacOSX? etc.  — Preceding unsigned comment added by 113.28.129.54 (talk) 02:15, 27 December 2013 (UTC)
replies: text: There are two parts: who implemented it, and who used it by default. A good starting point is http://crypto.stackexchange.com/questions/10189/who-uses-dual-ec-drbg Thue (talk) 03:23, 27 December 2013 (UTC)
thread_title:  List of Products using this algorithm 

message: Reuters has reported there was a RSA-NSA deal to set Dual_EC_DRBG, and RSA has not denied this. So the existence of this deal is not disputed, and is therefore not "alleged", and I am removing all "alleged" prefixes for this in the article. Thue (talk) 19:18, 2 January 2014 (UTC)
replies: text: What remains "alleged" is that receiving funding from the NSA is relevant here.  The NSA has been heavily involved with the encryption "industry" for a long time because they know a lot about encryption.--Brian Dell (talk) 19:51, 13 January 2014 (UTC)
thread_title:  RSA-NSA deal is not alleged 

message: http://dualec.org/
http://projectbullrun.org/dual-ec/
80.226.24.13 (talk) 08:05, 2 April 2014 (UTC)
thread_title:  Dual EC/TLS Vulnerability 

message: Hello fellow Wikipedians,
I have just modified  on Dual EC DRBG. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20131227190128/http://veridicalsystems.com/blog/secure-or-compliant-pick-one/ to http://veridicalsystems.com/blog/secure-or-compliant-pick-one/
*Added archive https://web.archive.org/web/20131227190128/http://veridicalsystems.com/blog/secure-or-compliant-pick-one/ to http://veridicalsystems.com/blog/secure-or-compliant-pick-one/
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—InternetArchiveBot (Report bug) 07:35, 17 December 2016 (UTC)
thread_title:  External links modified 

message: I believe by now that a number of programs use Dual EC, but have changed the bad parameters so it's now secure. Not sure how many programs use the fixed version, or if the fixed version is in any way backward compatible (a communication from a fixed program being able to send an encrypted message that can be read by an un-fixed program, or visa versa).  — Preceding unsigned comment added by 2601:601:F00:1010:59F7:107A:36EF:5204 (talk) 10:42, 22 September 2017 (UTC)
thread_title:  Need a section on fixed Dual EC