Not to pick on @SwiftOnSecurity here, but since Juniper and Dual EC are in the news, I think it’s worth revisiting the evidence that someone deliberately inserted Dual EC as a backdoor.
https://twitter.com/swiftonsecurity/status/1321462257683976193
For the full argument, see this excellent and readable summary my co-authors wrote: m-cacm.acm.org/magazines/2018…
But short summary: Juniper included two random number generators in their NetScreen devices. One was documented. The other was undocumented. The undocumented one was Dual EC. 1/
The Dual EC generator was included at the behest of a single customer, according to Juniper. So they knew it was present. They even included a switch to turn it on/off. However, they defaulted the switch to “on”. 2/
The inclusion of Dual EC significantly slowed down the RNG, so Juniper had to engineer a system that could pre-generate random values before they were needed. This was a non-trivial engineering effort, not a few lines of code. 3/
Juniper didn’t use the standard NIST parameters for Dual EC. They generated their own. This is even more work, and was never documented. Failing to document this made sure it could never be FIPS certified. 4/
Juniper also made a bunch of changes that are not strictly relevant to this thread, but that happened to make the system even more easily exploitable. See the article above. 5/
There is a fascinating error in the code for the second (non-Dual EC) generator that causes it not to run at all, resulting in raw Dual EC bytes being output on the wire. See if you can spot it. 6/ 
The last piece is the only part of this engineering effort that I think could legitimately, by itself, have been a mistake. But combined with all the other changes and the deliberate failure to disclose Dual EC was even present, it’s harder to look at it as an isolated error. 7/
Anyway, read the whole article above to see whether you agree or disagree with the idea that Juniper (or at least their engineers) could have been unaware of what they were doing. I’m skeptical as heck, and the lack of curiosity from both the company and FBI doesn’t help. 8/8
• • •
Missing some Tweet in this thread? You can try to
force a refresh
