Re: [gentoo-user] Re: Heartbleed fix - question re: replacing self-signed certs with real ones

[Mick <michaelkintzios@gmail.com>]

[-- Attachment #1: Type: Text/Plain, Size: 1300 bytes --]

On Friday 18 Apr 2014 19:08:21 Dale wrote:
> I'm a little vague on some things but it seems the claim was that NSA
> had some sort of backdoor that was built in from the beginning of the
> project for encryption which sounded like it would include httpS and
> others.  Again, the details are fuzzy.  I would say that I need to
> bookmark this sort of thing but I already have so many bookmarks that it
> is very hard to dig through them as it is.  Adding more may be
> counterproductive, yet again.

I think that you are referring to their Dual_EC_DRBG (Dual Elliptic Curve 
Deterministic Random Bit Generator) which is/was used by RSA Security (not RSA 
the algorithm developed by Ron Rivest, Adi Shamir and Leonard Adleman).

http://www.computing.co.uk/ctg/news/2295881/rsa-warns-customers-against-nsa-compromised-security-product#

I don't know if Schneier said, stay away from elliptic curve algos and use 
symmetric keys instead, because of this.  Others have tried to crack elliptic 
curves and have not been successful - so one has to tread carefully.  Given 
the NSA/NIST and big corporates are all in it up to their neck, I would guess 
that distrusting *everything* they have or could be behind is a healthy 
attitude to take at the moment.  ;-)

-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 490 bytes --]