NSA Backdoors and Bitcoin (2013)

https://chrispacia.wordpress.com/2013/10/30/nsa-backdoors-and-bitcoin/

by maxwell • 7 years ago

95 57 7 years ago

chrispacia.wordpress.com

api• 7 years ago

I still doubt that there's a backdoor in the NIST curves because they're still widely used and recommended for top secret information, among other reasons.

If there were a backdoor and it leaked (or the math behind it was independently rediscovered!) the result could be catastrophic. Snowden showed that the NSA is absolutely vulnerable to leaks.

garmaine4• 7 years ago

A trapdoor back door would require knowing some secret value. It is very much possible that this secret value could remain secret by not being written down in any electronic document. It would exist on some code breaking hardware, but like the cocoa cola recipe it could be known by only a few people in the world and still be useful.

ev0lv• 7 years ago

Somewhere exists a hardware key that breaks the blockchain encryption. This is a sweet movie idea.

nullc7• 7 years ago

The construction of the NIST curves essentially preludes trapdoors.

It doesn't completely preclude having a purposefully weak curve based on some publicly unknown weakness. ... but at the same time it also doesn't preclude the the curves having been selected to be stronger against some publicly unknown weakness (as was done with DES).

[Not that I'd recommend them.]

secfirstmd• 7 years ago

And Shadowbrokers showed the danger of when their code and exploits get leaked.

tptacek3• 7 years ago

This is silly. secp256k1 and secp256r1 are curves (or, standards based on parameters describing a curve). Dual_EC is a PKRNG that uses curves.

You don't need curve magic to see the problem with Dual_EC; it's an RNG that works by transforming its state with a public key encryption primitive, which begs the obvious question "who holds the private key?". Dual_EC was so obviously problematic (and so slow) that many people, Schneier included, questioned whether it actually was a backdoor at all (full disclosure: I'm one of those people).

To believe the NIST curves generated from random numbers are backdoored, you essentially have to believe that there is a class of curves susceptible to some hitherto unknown attack that is large enough that NSA could find it by brute forcing hashes, but not so large that any other researcher got any inkling that the vulnerability existed. In particular: unlike Dual_EC, which is straightforwardly a backdoor, with its own special key, for NIST curves to be "backdoored" there has to be some underlying vulnerability in a particular curve structure to exploit. This isn't my argument, by the way; it's shoplifted from Koblitz and Menezes.

You shouldn't use the NIST curves! They're hard to implement securely. Curve25519 has better ergonomics and is much safer out of the box. But conspiracy-theoretic stuff linking Dual_EC to NIST curves is always painful to read.

mantap2• 7 years ago

I don't think it's really a conspiracy theory. Recall that before the Dual_EC affair, the reputation of the NSA was that they were a benevolent force that helped strengthen DES against differential cryptanalysis before it was publicly discovered. The Dual_EC affair marked a turning point where people started to seriously consider the possiblility that the NSA was a malevolent actor weakening primatives for their own benefit.

Also the problem with Dual_EC wasn't just the bad design, but that they had (reportedly) paid RSA corporation to use it.

tptacek3• 7 years ago

I find comments like these absolutely baffling. I learned what the NSA was from Schneier's Applied Cryptography, which I bought when I was a senior in high school, back in 1994. Throughout the book, NSA is depicted as adversarial to cryptography. They're the NSA of the Clipper chip, and of global bans on cryptography, and "this t-shirt is a munition". There has never been a point in my professional life where NSA wasn't the global adversary.

Until I started talking about this stuff on HN, it never would have occurred to me that anyone would think NSA had this benevolent reputation. Based on the timing, I suspect that's not because I'm encountering people with different priors about NSA, but rather that I'm talking to people with no priors about NSA.

bcaa7f3a8bbc4• 7 years ago

Pseudorandom parameter selection of NIST P-curves, including secp256r1 has created much controversy within the cypherpunk community in the early 2000s. the theory is that the NSA discovered a class of secret curves with an unknown special weakness, and then bruteforced the random seed that would generate the weak curve. [0] On the other hand, secp256k1's parameters were not generated by random seeds. [1]

I think the important fact is not whether secp256r1 has a backdoor, but the decision of selecting secp256k1 by Satoshi Nakamoto for the use in Bitcoin. At the time, secp256k1 was the only widely-implemented non-P curve in various crypto libraries, and almost nobody used it at the time. It seems the entire decision of using secp256k1 was made to avoid secp256r1. This is another piece of evidence that Satoshi Nakamoto must have beee active in the 1990-2000 cypherpunk community, so that he was well-aware of those discussions. This should shed some light on his possible identity.

[0] DJB's paper how to manipulate curve standards [2] is DJB's attempt of creating the strongest argument for this claim. But even in his analysis, overall it's not too plausible, there's little evidence that such a class of secret curves exists and it required huge computation (2^80), it's on the edge of what was possible, but the pseudorandom parameter selection is certainly technically unfavorable as he demonstrated.

[1] https://safecurves.cr.yp.to/rigid.html

[2] https://eprint.iacr.org/2014/571.pdf

pg_is_a_butt• 7 years ago

It seems the entire decision of using secp256k1 was made to avoid secp256r1. This is another piece of evidence that Satoshi Nakamoto must have beee active in the 1990-2000 cypherpunk community, so that he was well-aware of those discussions. This should shed some light on his possible identity.

I was well aware of all that, at the time and now, without being active in the cypherpunk community. Granted, I was in college for a CS and math degree, but the cypherpunk community was pretty loud if you were listening at all.

bcaa7f3a8bbc4• 7 years ago

Yes, it's another way to interpret his choice. "Satoshi being a member of the Cypherpunk" is only one possibility. It's entirely possible that he wasn't active at all, and his familiarity of Cypherpunks was from his learning, not from the participation.

sunstone2• 7 years ago

karma -50 and account created in 2013 :D pg_is_a_butt is my alter ego. I'm not worthy. (though my account was hell banned for a long time and I soldiered on regardless :)

Ok I think it's our civic duty to follow pg_is_a_butt around and upvote his comments :D pg_is_a_butt 10k karma or bust!

nonefromabove• 7 years ago

"Evidence that Satoshi Nakamoto must have beee active in the 1990-2000 cypherpunk community, so that he was well-aware of those discussions. This should shed some light on his possible identity."

I dont think so .... that's just noise. He might have just asked around and received advise from friends/colleagues or random stranger what should be avoided. You are reading too much into this. This sheds no light on possible identity. Only identity it sheds light on is how your mind works with tiny information and how you confuse noise for signal.

BubRoss• 7 years ago

You are claiming it is noise with no reasoning behind it. If his friends or colleagues knew about this curve, wouldn't that imply they were part of the community.and this he was part of the community?

I'm not sure why you would take such a strong position that amounts to 'nope just noise'.

dang2• 7 years ago

Hey, can you please not cross into personal attack here? That's against the site rules, because we're trying for a bit better than internet default in this community.

If you wouldn't mind reading https://news.ycombinator.com/newsguidelines.html and participating in the spirit of this site, we'd be grateful. Your comment would be fine without the last sentence.

truantbuick• 7 years ago

I don't know specifically about secp256r1, but in general, I think there were already a lot of suspicions and most people were wary of any ECC curves NIST or NSA had chosen by 2008 when Bitcoin was developed. [1]

In a purported email [2] (reasonably well attested to) from Satoshi Nakamato, he claimed

I didn't find anything to recommend a curve type so I just... picked one.

[1] https://web.archive.org/web/20140621062515/http://archive.wi...

[2] https://archive.is/lHHSk

bcaa7f3a8bbc4• 7 years ago

Interesting, I didn't know the existence of the quote or the mail. So... if what Satoshi claimed is true, this choice was actually a pure coincidence and doesn't really have any significance, hmm. I don't know what to say - yet another strange coincidence in history I guess?

LinuxBender3• 7 years ago

If there are fears and doubts, perhaps it would be safest to just assume the transport is clear text in risk ranking and adapt other counter-measures to fill perceived gaps.

For really sensitive flows, perhaps dark fiber + non standard ciphers + encrypting the payload with application layer encryption using non standard or custom ciphers. I mean, why not, if it's your own B2B flows. Take an existing cipher / protocol and make a few subtle changes. It's just math.

For end-user encryption, that would take some more thought and would probably get into layers of turtles.

robbya• 7 years ago

There's a lot of ways to get encryption wrong. A few subtle changes could undo a very deliberate countermeasure for a somewhat obscure vulnerability. I don't think that's good advice.

LinuxBender3• 7 years ago

I agree, but I would probably do it anyway if I were mitigating someones concerns. It could be a layer on top of the standard ciphers / protocols. I certainly would not do this for end-user comms. For B2B if you control both ends, maybe its a risk worth taking. Each entity would have to weigh the risks.

arcticbull2• 7 years ago

Rolling your own crypto is dreadful advice. You’re making tweaks to something to avoid a backdoor you don’t know exists and in the process likely opening yourself up a gaping hole in the middle.

LinuxBender3• 7 years ago

Oh I would not suggest rolling your own crypto. Rather, just fork openssl and make a very subtle change to each formula. For in-house use of course.

Ages ago, I used to change up a rubix-cube for a friend. The more I changed it, the quicker he could solve it. If I made just a very subtle change, it would take him up to an extra 7 seconds to solve it.

jasonvorhe• 7 years ago

This is terrible advice, sorry.

NelsonMinar2• 7 years ago

So this article is six years old. Any update on the supposition? I guess no one's figured out yet whether the recommended magic number is a back door or not. My money is definitely on corrupted.

Odd the article doesn't mention the obvious conclusion; that Bitcoin was designed by NSA, or folks with intimate knowledge of NSA's back doors. I've long maintained that a US government agency is the most likely developer of Bitcoin (mostly because no one else could sit on that kind of $$$ forever). NSA is the most obvious agency. The question is.. why? I can speculate on lots of reasons.

cyphertruck5• 7 years ago

Bitcoin was designed by an individual with intimate knowledge of the state of the art in suspicions of NSA backdoors.

You are assuming Satoshi is sitting on money. Satoshi took care to hide it’s identity, and thus would have switched mining to different addresses very early in bitcoins history.

It would have been obvious to Satoshi that spending from a known address would blow it’s identity, so only did so for testing.

Satoshi may well be a billionaire and spending bitcoin every day.

People seem to take comfort in this idea that bitcoin was created by a government... because bitcoin seems radical when you first learn about it. However the attempts to create it date back a couple decades before it was created. Satoshi combined existing inventions with just the new element of his time chain.

But even if the NSA were behind it, what could they do? Anything they could do could also be done by someone with a math breakthrough. So whether the attacker is the NSA or not bitcoin has to be robust against it.

So where is bitcoin vulnerable?

It’s easy to imagine vulnerabilities in the cryptography, but hard to produce them.

Further, if you did, it doesn’t necessarily affect bitcoin. This is bitcoin’s genius. It’s not software, it’s a set of incentives. Show an error in the software, it will be patched and bitcoin will carry on. Worst case is a hard fork.

real_satoshi• 7 years ago

Bitcoin was designed by an individual with intimate knowledge of the state of the art in suspicions of NSA backdoors.

Insiders at the NSA (or any other TLA, foreign or domestic) also fit this description. The strongest position is to know both the truth, and the most compelling misconceptions.

wil4212• 7 years ago

My thoughts exactly regarding the NSA creating Bitcoin. My theory is the blockchain gives them a way to do analysis on dirty money. Instead of having to hack or compel the next dirty bank they can look at the open ledger and figure it out. At first I thought it could be the CIA as a way to fund off the books ops but NSA makes more sense.

Either way there’s no way a single person holds on to a wallet that size. It’s also less likely someone/some group in China or Russia could hold on to wallet that size without it being pilfered.

cyphertruck5• 7 years ago

You’re projecting your temptation into people based on your values, as is Nelson. But you are not Satoshi. Satoshi faces risk worse than Edward Snowden. The central bankers are far more formidable.

And the solution is easy: Satoshi mined initially to bootstrap bitcoin. He was the only one mining in the early days.

But then once there were enough other miners, all he had to do was destroy his private key.

If he’s greedy he just waited until he had enough bitcoin mined in other addresses that were never associated with him, before doing so.

Zero temptation. And hard to feel much regret... because he had opportunity to mine a great deal in those early years.

NSA Backdoors and Bitcoin (2013)

Related Stories