Cryptography

NIST recommends against NSA-influenced standards

abstract head representing big data

The National Institute of Standards and Technology, the agency that sets guidelines, policy and standards used by computer systems in the federal government and worldwide, now "strongly" recommends against using an encryption standard that leaked top-secret documents show was weakened by the National Security Agency.

NIST's Information Technology Laboratory recently authored a technical bulletin that urges users not to make use of Special Publication (SP) 800-90A, which was reopened for public comment with draft Special Publications 800-90B and 800-90C on Sept. 10, providing the cryptographic community another chance to comment on encryption standards that were approved by NIST in 2006.

"NIST strongly recommends that, pending the resolution of the security concerns and the re-issuance of SP 800-90A, the Dual_EC_DRBG, as specified in the January 2012 version of SP 800-90A, no longer be used," the bulletin states.

Dual_EC_DRBG is the acronym for the Dual Elliptic Curve Deterministic Random Bit Generation algorithm found within the SP 800-90A. The issue was identified during the standard's development process and addressed, though the trustworthiness of that correction has been called into question, according to the bulletin.

NIST has been under fire since top-secret documents leaked by former National Security Agency contractor Edward Snowden showed the NSA "became the sole editor" of the encryption standards in question and apparently introduced weaknesses into them.

NIST has been quick to address questions about its integrity, both in reopening to public scrutiny the standards themselves – used by approximately 70 government vendors –and through public statements.

"We are not deliberately, knowingly working to undermine encryption standards, and one way we ensure that integrity is by ensuring our work is done in the full light of the public," said NIST Director Patrick Gallagher, speaking at the Amazon Web Services Public Sector Summit 2013 on Sept. 10.

NIST has made sure to explain how it "uses a transparent, public process to rigorously vet its standards and guidelines," but it has also tactfully explained why it works with the NSA, the largest employer of cryptographers in the world: The law says it has to.

"The NSA participates in the NIST cryptography development process because of its recognized expertise," according to a NIST statement. "NIST is also required by statute to consult with the NSA."

About the Author

Frank Konkel is a former staff writer for FCW.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.