Security Questions Linger As Juniper Removes Suspicious Dual_EC Algorithm [serious technobabble]

Threatpost.com ^ | 1/11/2016 | Michael Mimoso

[Fhios]

Juniper Networks announced late Friday it was removing the suspicious Dual_EC_DRBG random number generator from its ScreenOS operating system.

And while that’s heralded as a positive move considering Dual_EC’s dubious origins, there remain important and unanswered questions about Juniper’s decision to include what is considered to be a backdoored random number generator in its NetScreen VPNs, and why a number of strange coding and engineering decisions were made that could have facilitated the decryption of secure traffic.

[Fhios]

Loosely translated: The Every Government from A-Z is spying on you.

[Billthedrill]

Oh, dear. Translated as best I can: a VPN (Virtual Private Network) is a system wherein the user "tunnels" through using encryption that is based on a random number generator (in this case), which, if not random or otherwise compromised, allows realtime decryption by a third party who is capturing the packets.

Dang, that isn't much better. Sorry.

[freeandfreezing]

Simple summary -- somebody put a backdoor into the Juniper code so spies could access the supposedly secure data. From the article:

"It's very bizarre. I've never seen anything like that before where gone from something that was working and written in a standard manner to something as strange as this," he said. It's that bug that enabled another attacker to replace the Dual_EC constant - thought to belong to the NSA - with their own constant."The very presence of Dual_EC enabled a third party to simply change a constant and make it so they were able to decrypt VPN traffic," Checkoway said...

This is an example of why the kind of backdoor access our security agencies want is a bad idea. Other people find the back door and pretty soon everybody and his cousin are busy reading other people's private information.

[Bobalu]

I do NOT trust the hardware RNG that many processor types have built in.

Just too tempting for government to bribe or threaten hardware manufacturers into weakening.

I build my own RNG using something like diode noise as a source.