NIST denies NSA tampering with encryption standards
Although NIST must work with NSA by law, the agency maintains a public vetting process for all encryption standards
IDG News Service - The U.S. National Institute of Standards and Technology (NIST) has vigorously denied that the U.S. National Security Agency (NSA) tampered with NIST's process of vetting and choosing encryption algorithms.
"NIST would not deliberately weaken a cryptographic standard," NIST said in a statement Tuesday. "We will continue in our mission to work with the cryptographic community to create the strongest possible encryption standards for the U.S. government and industry at large."
The statement was issued five days after The New York Times accused the NSA of circumnavigating the NIST-approved encryption algorithms used to secure electronic communications, either by introducing virtually undetectable back doors in the algorithms or by subverting the public development process to weaken new encryption algorithms and supporting technologies.
NIST led development of many of the algorithms used to encrypt data on the Internet, such as AES (Advanced Encryption Standard) and the now largely defunct DES (Digital Encryption Standard). Both AES and DES are used in SSL (Secure Socket Layer), the protocol used by browsers to secure sensitive data.
In addition to issuing the statement, NIST has also reopened public comments for a number of proposed encryption related standards, namely Special Publication 800-90A and draft Special Publications 800-90B and 800-90C, which cover the random bit generators that provide random numbers to seed encryption keys.
NIST noted that it has worked closely with the NSA to help develop encryption standards, due to the NSA's expertise in this area. NIST is also required to consult with the NSA by U.S. legal statute. But the agency noted that its process for vetting encryption algorithms is an open one, in which anyone can review and comment on the work being done.
"If vulnerabilities are found in these or any other NIST standards, we will work with the cryptographic community to address them as quickly as possible," the statement read.
- Agility & Scalability for Oracle EBS R12 and RAC on VMware vSphere 5 This white paper outlines extensive performance and scalability testing of Oracle EBS applications on a Vblock™ Systems with vSphere 5.
- Oracle and VCE: The Next Step in Integrated Computing Platforms In this ESG Lab review you will learn how a VCE system driven by Oracle, delivers the perfect blend of high performance and...
- Migrate Oracle Apps from RISC/UNIX to Virtualized x86 Ready to move Oracle to a virtualized environment? This brief explains how true converged infrastructure can help you migrate from a RISC/UNIX environment...
- Step Out of the Bull's-Eye Learn about the evolution of targeted attacks, the latest in security intelligence, and strategic steps to keep your business safe.
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily...
- On Demand: Mastering the Art of Mobile Content Management Mobile device usage in the enterprise has skyrocketed, and it continues to escalate. IT must answer to users who demand access to their... All Encryption White Papers | Webcasts