RSA chief believed cryptographers’ warnings on Dual EC DRBG lacked merit (2014)
Two things real quick:<p>Art Coviello is a salesman who headed the company that <i>bought</i> RSA and took the name. It would be a little weird to expect him to meaningfully know what a cryptographer even is. The idea that Coviello would himself be weighing NIST against crypto eprints is pretty silly.<p>And, more importantly, the only important cite here is Shumow and Ferguson. Schneier didn&#x27;t analyze Dual EC (he never did work in elliptic curves at all, and claimed not to trust their math); here, he&#x27;s simply reporting on Shumow and Ferguson&#x27;s paper, and he doesn&#x27;t even say Dual EC was backdoored. Nor, for that matter, do the cites before Shumow and Ferguson.<p>(Before anyone jumps on my back about this: I basically shared Schneier&#x27;s take on this, that Dual EC was too conspicuous to really be a backdoor, and that the right response was to ignore and never use it. I was wildly wrong about how prevalent Dual EC was --- I couldn&#x27;t imagine any sane engineer adopting it, because it&#x27;s slow and gross. If I&#x27;d known before the BULLRUN revelations that, for instance, every Juniper VPN box was using Dual EC, I&#x27;d have been a lot more alarmed and a lot less charitable about it. Oh well, live and learn.)