Formal NIST recommendation for Dual_EC_DRBG to be withdrawn

Summary:NIST is one step away from removing the NSA-backdoored Dual Elliptic Curve Deterministic Random Bit Generator from its set of recommended algorithms to generate random numbers.

The National Institute of Standards and Technology (NIST) has announced that it is set to remove the Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG) algorithm from its guidance on random number generators.

NIST will conduct a final round of public comments on a new draft of its Recommendation for Random Number Generation Using Deterministic Random Bit Generators (PDF), before codifying its standing recommendation to avoid the use of Dual_EC_DRBG where possible.

"NIST recommends that current users of Dual_EC_DRBG transition to one of the three remaining approved algorithms as quickly as possible," NIST said in its announcement.

NIST said that it took the decision to remove Dual_EC_DRBG after a period of public comment and review.

The reissuing of its random number generation recommendation will complete a process that NIST began in September of last year following reports from The New York Times that the NSA had worked to backdoor Dual_EC_DRBG.

In December, accusations that RSA had received US$10m to default the flawed Dual_EC_DRBG algorithm in its products were made.

"RSA, as a security company, never divulges details of customer engagements, but we also categorically state that we have never entered into any contract or engaged in any project with the intention of weakening RSA's products, or introducing potential 'backdoors' into our products for anyone's use," RSA said at the time.

In September 2013, RSA had advised its customers to move away from using Dual_EC_DRBG.

Public comment on the NIST draft will close on May 23

Topics: Security

About

Chris started his journalistic adventure in 2006 as the Editor of Builder AU after originally joining CBS as a programmer. After a Canadian sojourn, he returned in 2011 as the Editor of TechRepublic Australia, and is now the Australian Editor of ZDNet.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.