RSA Tells Its Developer Customers: Stop Using NSA-Linked Algorithm

[InfoSec News <alerts () infosecnews org>]

http://www.wired.com/threatlevel/2013/09/rsa-advisory-nsa-algorithm/

By Kim Zetter
Threat Level
Wired.com
09.19.13

Amidst all of the confusion and concern over an encryption algorithm that 
may contain an NSA backdoor, RSA Security released an advisory to 
developer customers today noting that the algorithm is the default in one 
of its toolkits and strongly advising them to stop using the algorithm.

The advisory provides developers with information about how to change the 
default to one of a number of other random number generator algorithms RSA 
supports and notes that RSA has also changed the default on its end in 
BSafe and in an RSA key management system.

The company is the first to go public with such an announcement in the 
wake of revelations by the New York Times that the NSA may have inserted 
an intentional weakness in the algorithm — known as Dual Elliptic Curve 
Deterministic Random Bit Generation (or Dual EC DRBG) — and then used its 
influence to get the algorithm added to a national standard issued by the 
National Institute of Standards and Technology.

In its advisory, RSA said that all versions of RSA BSAFE Toolkits, 
including all versions of Crypto-C ME, Micro Edition Suite, Crypto-J, 
Cert-J, SSL-J, Crypto-C, Cert-C, SSL-C were affected.

[...]

--
Find the best InfoSec talent without breaking your
recruiting budget! Post a Job, $99 for 31 days.
Hot InfoSec Jobs - http://www.hotinfosecjobs.com/