NIST SP 800-90A

From HandWiki

NIST SP 800-90A ("SP" stands for "special publication") is a publication by the National Institute of Standards and Technology with the title Recommendation for Random Number Generation Using Deterministic Random Bit Generators. The publication contains the specification for three allegedly cryptographically secure pseudorandom number generators for use in cryptography: Hash DRBG (based on hash functions), HMAC DRBG (based on HMAC), and CTR DRBG (based on block ciphers in counter mode). Earlier versions included a fourth generator, Dual EC DRBG (based on elliptic curve cryptography). Dual_EC_DRBG was later reported to probably contain a kleptographic backdoor inserted by the United States National Security Agency (NSA).

History

NIST SP 800-90A was published by the National Institute of Standards and Technology in June 2006 as NIST SP 800-90 with the title Recommendation for Random Number Generation Using Deterministic Random Bit Generators.[1] The publication contains the specification for three allegedly cryptographically secure pseudorandom number generators for use in cryptography: Hash DRBG (based on hash functions), HMAC DRBG (based on HMAC), and CTR DRBG (based on block ciphers in counter mode).

Since June 24, 2015, the current version of the publication is Revision 1. Earlier versions included a fourth generator, Dual EC DRBG (based on elliptic curve cryptography). Dual_EC_DRBG was later reported to probably contain a kleptographic backdoor inserted by the United States National Security Agency (NSA), while the other three random number generators are accepted as uncontroversial and secure by multiple cryptographers.[2][3]

As a work of the US Federal Government, NIST SP 800-90A is in the public domain and freely available.

Security analysis

Dual_EC_DRBG

An attempted security proof for Dual_EC_DRBG states that it requires three problems to be mathematically hard in order for Dual_EC_DRBG to be secure: the decisional Diffie-Hellman problem, the x-logarithm problem, and the truncated point problem.[4] The decisional Diffie-Hellman problem is widely accepted as hard.[4] The x-logarithm problem is not widely accepted as hard. Some evidence is shown that this problem is hard but that evidence is not conclusive.[4] The security proof is therefore questionable and would be proven invalid if the x-logarithm problem is shown to be efficiently solvable. The truncated point problem requires enough bits to be truncated from the point selected by Dual_EC_DRBG to make it indistinguishable from a truly random number.[4] However, the truncation of 16 bits, the default specified by the Dual_EC_DRBG standard, has been shown to be insufficient to make the output indistinguishable from a true random number generator[5] and therefore invalidates Dual_EC_DRBG's security proof when the default truncation value is used.

Backdoor in Dual_EC_DRBG

As part of the Bullrun program, NSA has inserted backdoors into cryptography systems. One such target was suggested in 2013 to be Dual_EC_DRBG.[6] The NSA accomplished this by working during the standardization process to eventually become the sole editor of the standard.[7] In getting Dual_EC_DRBG accepted into NIST SP 800-90A, NSA cited prominent security firm RSA Security's usage of Dual_EC_DRBG in their products. However, RSA Security had been paid $10 million by NSA to use Dual_EC_DRBG as default, in a deal that Reuters describes as "handled by business leaders rather than pure technologists". As the $10 million contract to get RSA Security to use Dual_EC_DRBG was described by Reuters as secret, the people involved in the process of accepting Dual_EC_DRBG into NIST SP 800-90A were presumably not made aware of this obvious conflict of interest.[8] This might help explain how a random number generator later shown to be inferior to the alternatives (in addition to the back door) made it into the NIST SP 800-90A standard.

The potential for a backdoor in Dual_EC_DRBG had already been documented by Dan Shumow and Niels Ferguson in 2007,[9] but continued to be used in practice by companies such as RSA Security until the 2013 revelation.[2] Given the known flaws in Dual_EC_DRBG, there have subsequently been accusations that RSA Security knowingly inserted a NSA backdoor into its products. RSA has denied knowingly inserting a backdoor into its products.[10]

Following the NSA backdoor revelation, NIST has reopened the public vetting process for the NIST SP 800-90A standard.[6][11] A revised version of NIST SP 800-90A that removes Dual_EC_DRBG was published in June 2015.[12]

Hash_DRBG and HMAC_DRBG

Hash_DRBG and HMAC_DRBG have security proofs for a single call to generate pseudorandom numbers.[13] The paper proving the security of Hash_DRBG and HMAC_DRBG does cite the attempted security proof for Dual_EC_DRBG used in the previous paragraph as a security proof to say that one should not use CTR_DRBG because it is the only DRBG in NIST SP 800-90A that lacks a security proof.[13]

HMAC_DRBG also has a machine-verified security proof.[14] The thesis containing the machine-verified security proof also proves that a compromise of a properly-implemented instance of HMAC_DRBG does not compromise the security of the numbers generated before the compromise.[14]

CTR_DRBG

CTR_DRBG has been shown to have a theoretical imperfection when used with certain parameters because cryptographers did not consider the block size of the cipher when designing this pseudorandom number generator.[15] CTR_DRBG appears secure and indistinguishable from a true random source when AES is used as the underlying block cipher and 112 bits are taken from this pseudorandom number generator.[15] When AES is used as the underlying block cipher and 128 bits are taken from each instantiation, the required security level is delivered with the caveat that a 128-bit cipher's output in counter mode can be distinguished from a true random number generator.[15] When AES is used as the underlying block cipher and more than 128 bits are taken from this pseudorandom number generator, then the resulting security level is limited by the block size instead of the key size and therefore the actual security level is much less than the security level implied by the key size.[15] CTR_DRBG is also shown to fail to deliver the expected security level whenever Triple DES is used because its 64-bit block size is much less than the 112-bit key size used for Triple DES.[15]

There is currently no known method to exploit this issue when AES is used.

NIST SP 800-90A version history

See also

References

  1. ↑ Barker, Elaine; Kelsey, John (June 2006). "NIST Special Publication 800-90: Recommendation for Random Number Generation Using Deterministic Random Bit Generators". National Institute of Standards and Technology. http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-90.pdf. 
  2. ↑ 2.0 2.1 Green, Matthew (2013-09-20). "RSA warns developers not to use RSA products". http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html. Retrieved 2014-08-23. 
  3. ↑ Schneier, Bruce (November 15, 2007). "The Strange Story of Dual_EC_DRBG". https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html. 
  4. ↑ 4.0 4.1 4.2 4.3 Brown, Daniel R. L.; Gjøsteen, Kristian (February 15, 2007). "A Security Analysis of the NIST SP 800-90 Elliptic Curve Random Number Generator". http://eprint.iacr.org/2007/048.pdf. 
  5. ↑ Schoenmakers, Berry; Sidorenko, Andrey (May 29, 2006). "Cryptanalysis of the Dual Elliptic Curve Pseudorandom Generator". http://eprint.iacr.org/2006/190.pdf. 
  6. ↑ 6.0 6.1 Perlroth, Nicole (2013-09-10). "Government Announces Steps to Restore Confidence on Encryption Standards". New York Times. http://bits.blogs.nytimes.com/2013/09/10/government-announces-steps-to-restore-confidence-on-encryption-standards/. Retrieved 2014-08-23. 
  7. ↑ Ball, James; Borger, Julian; Greenwald, Glenn (2013-09-05). "Revealed: how US and UK spy agencies defeat internet privacy and security". The Guardian. https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security. Retrieved 2014-08-23. 
  8. ↑ Menn, Joseph (2013-12-20). "Exclusive: Secret contract tied NSA and security industry pioneer". Reuters. https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220. Retrieved 2014-08-23. 
  9. ↑ Bruce Schneier (2007-11-15). "Did NSA Put a Secret Backdoor in New Encryption Standard?". Wired News. Archived from the original on 2015-11-23. https://web.archive.org/web/20151123065121/http://www.wired.com/2007/11/securitymatters-1115. Retrieved 2014-08-23.  Alt URL
  10. ↑ Goodin, Dan (2013-09-20). "We don't enable backdoors in our crypto products, RSA tells customers". Ars Technica. https://arstechnica.com/security/2013/09/we-dont-enable-backdoors-in-our-crypto-products-rsa-tells-customers/. Retrieved 2014-08-23. 
  11. ↑ "NIST Invites Comments on Draft SP 800-90A, Revision 1". National Institute of Standards and Technology. 2014-04-21. Archived from the original on 2014-07-23. https://web.archive.org/web/20140723001417/http://csrc.nist.gov/groups/ST/toolkit/800-90A-RFC.html. Retrieved 2014-08-23. 
  12. ↑ Barker, Elaine; Kelsey, John (June 2015). NIST Released Special Publication (SP) 800-90A Revision 1: Recommendation for Random Number Generation Using Deterministic Random Bit Generators. National Institute of Standards and Technology. doi:10.6028/NIST.SP.800-90Ar1. http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf. Retrieved November 19, 2016. 
  13. ↑ 13.0 13.1 Kan, Wilson (September 4, 2007). "Analysis of Underlying Assumptions in NIST DRBGs". https://eprint.iacr.org/2007/345.pdf. 
  14. ↑ 14.0 14.1 Ye, Katherine Qinru (April 2016). "The Notorious PRG: Formal verification of the HMAC-DRBG pseudorandom number generator". https://www.cs.cmu.edu/~kqy/resources/thesis.pdf. 
  15. ↑ 15.0 15.1 15.2 15.3 15.4 Campagna, Matthew J. (November 1, 2006). "Security Bounds for the NIST Codebook-based Deterministic Random Bit Generator". http://eprint.iacr.org/2006/379.pdf. 

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=NIST_SP_800-90A&oldid=3370102"