Juniper: Recording Some Twitter Conversations
Stop and consider for a second how crazy this page is:https://kb.juniper.net/InfoCenter/index?page=content&id=KB28...Dual_EC is a PKRNG. PKRNGs are a kind of crypto random number generator (CSPRNG). All the crypto keys in modern cryptosystems come from CSPRNGS.PKRNGs are special because they embed a public key in the generator. Anyone who holds the corresponding private key can "decrypt" the output of the RNG and recover the generator's "state"; once they have that, they can fast-forward and rewind through it to find all the other numbers (read: crypto keys) it can generate.Juniper is here saying that they recognize the problem of Dual_EC --- it's a PKRNG, and the USG may hold its private key.So instead, they generated their own private keys and embedded them in the CSPRNGs of the VPNs they sold to customers.WAT?But see also this thread:https://news.ycombinator.com/item?id=10764359