Snowden disclosures prompt warning on widely used computer security formula

By Joseph Menn

SAN FRANCISCO (Reuters) - In the latest fallout from Edward Snowden's intelligence disclosures, a major U.S. computer security company warned thousands of customers on Thursday to stop using software that relies on a weak mathematical formula developed by the National Security Agency.

RSA, the security arm of storage company EMC Corp, told current customers in an email that a toolkit for developers had a default random-number generator using the weak formula, and that customers should switch to one of several other formulas in the product.

Last week, the New York Times reported that Snowden's cache of documents from his time working for an NSA contractor showed that the agency used its public participation in the process for setting voluntary cryptography standards, run by the government's National Institute of Standards and Technology, to push for a formula that it knew it could break.

NIST, which accepted the NSA proposal in 2006 as one of four systems acceptable for government use, this week said it would reconsider that inclusion in the wake of questions about its security.

But RSA's warning underscores how the slow-moving standards process and industry practices could leave many users exposed to hacking by the NSA or others who could exploit the same flaw for years to come.

RSA had no immediate comment. It was unclear how the company could reach all the former customers of its development tools, let alone how those programmers could in turn reach all of their customers.

Developers who used RSA's "BSAFE" kit wrote code for Web browsers, other software, and hardware components to increase their security. Random numbers are a core part of much modern cryptography, and the ability to guess what they are renders those formulas vulnerable.

The NSA-promoted formula was odd enough that some experts speculated for years that it was flawed by design. A person familiar with the process told Reuters that NIST accepted it in part because many government agencies were already using it.

But after the Times report, NIST said it was inviting public comments as it re-evaluated the formula.

"If vulnerabilities are found in these or any other NIST standards, we will work with the cryptographic community to address them as quickly as possible," NIST said on September 10.

Snowden, who is wanted on U.S. espionage charges and is living in temporary asylum in Russia, disclosed secret NSA programs involving the collection of telephone and email data. (Reporting by Joseph Menn; Editing by Eric Beech)

Matches

MORE TOP STORIES TODAY

Time for Chennai to enter familiar cocoon

Time for Chennai to enter familiar cocoon

Chennai have an emphatic 8-3 lead in the head-to-head with Punjab, with one game tied More »

Evenly matched Rajasthan and Hyderabad face-off

Evenly matched Rajasthan and Hyderabad face-off

A quality that defines Rajasthan and Hyderabad is consistency. Rajasthan was one among two teams to enjoy complete dominance at home last season. Hyderabad… More »

Beleaguered Yuvraj tees off to Sharjah's delight

Beleaguered Yuvraj tees off to Sharjah's delight

Yuvraj Singh was hardly convincing to begin with against Delhi, but a big dose of crowd support and a helping of poor bowling meant he had the opportunity… More »

Fiery star Stokes bids to curb his temper

Fiery star Stokes bids to curb his temper

England all-rounder Ben Stokes admits he must keep his anger under control if he is to end his international exile. More »

Troubled Trott to take another break

Troubled Trott to take another break

Jonathan pulled out of England's tour to Australia Brisbane with a 'stress-related illness'. More »

Bangalore's arsenal blazes to victory

Bangalore's arsenal blazes to victory

Yuvraj Singh was back to his best in his first match for Royal Challengers Bangalore. More »

Pakistan cricketers face probe

Pakistan cricketers face probe

Pakistani cricket authorities have launched an investigation after a number of current international stars played in exhibition matches in the United States… More »

BCCI to meet before next court hearing

BCCI to meet before next court hearing

The BCCI will hold an emergent working committee meeting on April 20 to discuss the future course of action with regard to the Supreme Court hearing concerning… More »

Gavaskar wants a clean IPL

Gavaskar wants a clean IPL

"Integrity is non-negotiable..." says the BCCI's interim chief ahead of Season 7 of the tainted league. More »

'Yak' Kallis still on top of his game

'Yak' Kallis still on top of his game

The 38-year-old South African veteran turned it on for Kolkata Knight RIders in the opening match of IPL-7. More »

Srinivasan named in fixing report: SC

Srinivasan named in fixing report: SC

The court emphasised that the tainted administrator can no longer work for the BCCI. More »

Kallis, Narine star in KKR win

Kallis, Narine star in KKR win

An all-round display saw Knight Riders thump Mumbai Indians by 41 runs in the IPL-7 opener. More »

Yuvraj happy to play for RCB: Kohli

Yuvraj happy to play for RCB: Kohli

New-look RCB will play their first game of IPL-7 on Thursday. More »

IPL: News Line

IPL: News Line

A round-up of all the news from this season of the IPL. More »

Shane Watson issues moral warning

Shane Watson issues moral warning

'Everyone knows what is right and what is wrong and if you do the wrong thing it will be found out' More »

Why I'm not looking forward to the IPL

Why I'm not looking forward to the IPL

Welcome to another season of a league that many watch but few trust. More »

Johnson may quit T20s for Tests

Johnson may quit T20s for Tests

Australia's Mitchell Johnson may quit limited-overs cricket to prolong his test career with an eye on the 2015 Ashes series in England, the fast bowler… More »

There's a lot going on: Fleming

There's a lot going on: Fleming

He experienced anxious moments in the lead-up to the tournament as the courts decided on whether to suspend the franchise, he said, but stressed that the… More »

Nepal players call off boycott

Nepal players call off boycott

Thaw in relations after formation of an advisory committee that would work in tandem with the Cricket Association of Nepal. More »

Latif couldn’t work with tainted players

Latif couldn’t work with tainted players

Former Pakistan cricket captain Rashid Latif said Tuesday he turned down the job of national chief selector because he could not work with ex-players tainted… More »

We are not over-confident: Bailey

We are not over-confident: Bailey

Indian Premier League — George Bailey-led Kings XI Punjab will face Chennai Super Kings on Friday. More »

Big runs expected, with bat and ball

Big runs expected, with bat and ball

Royal Challengers Bangalore: Their main concern, once again, is the fast bowling More »

Taxing issue — BCCI hits roadblock

Taxing issue — BCCI hits roadblock

MoU between BCCI & its units to avoid double taxation delayed after a few decline to share details. More »

Black Caps pick rookie duo for West Indies

Black Caps pick rookie duo for West Indies

New Zealand selectors included two new caps in a 15-man Test squad named Tuesday to tour the West Indies, with injury-hit spinner Dan Vettori's future… More »