Hacker News new | ask | show | jobs
by ig1 4560 days ago
It's basically a non-denial, they don't deny that they took money in exchange for using the backdoored algorithm.

If they took the money and didn't know the algo was backdoored both the original allegation and denial could be factually correct.

2 comments

I have admire the careful wording: "We also categorically state that we have never entered into any contract or engaged in any project with the intention of weakening RSA's products, or introducing potential 'backdoors' into our products for anyone's use."

This leaves the door open for a lot of things, including them having weakened their products and added backdoors. They just deny having entered a contract with the intention of doing so.

Though one has to wonder how exactly that deal went down. You wouldn't have to pay RSA anything to implement a good crypto algorithm because they'd do that out of pure business interest. Did the NSA call and ask "Here's a new RNG algorithm, it's slower than others and mathematically dubious. Would you implement it for $10 million?"

Most probably they said something like "many of your government agency customers would be very happy if / will require that you implemented this PRNG".
My guess would be the RSA wanted more government contracts and the NSA said they would have to implement the government preferred algo as the default. The NSA will also pay you for these efforts. RSA would see that is win-win. They are getting paid to implement the gov standard AND it will help them win contracts in the future. Only a fool would say no to that.
Even if they "didn't know", it's still commercial fraud. Had it been known that the NSA paid them for their choice of algorithm, there is no way a sane IT purchaser would have bought their solution, whether or not there was explicit knowledge of a backdoor.