RDRAND

Cryptography needs random numbers, numbers unpredictable to an adversary. Computers are built to be as non random as possible, so this is a problem.  Intel created an instruction, RDRAND, that supposedly creates a random number on each read.

This instruction appears to be backdoored by the NSA.

The numbers produced by any random physical process are always offwhite, in ways characteristic of that physical process, and diagnostic of the underlying physics. Because the numbers are whitened on chip, because we don’t see the raw output, we cannot tell if the underlying physical process generating randomness has failed, has been turned off by the NSA, or ever existed at all.  The decision to whiten the numbers on chip is a most strange one. It costs a bit of silicon, and lessens the utility of the physical random number generator, assuming there is a physical random number generator, for because of on chip whitening, there is no way to tell if there really is a physical random number generator or not.

This strange decision created much suspicion.

One of the designers responded to this suspicion, and my interpretation of his words is that he is a very bad liar, which is to say, his lies are both wicked and incompetent.

On 2013-09-08 3:48 AM, on the Cryptography Mailing list, David Johnston wrote:

It interesting to consider the possibilities of corruption and deception that may exist in product design. It’s a lot more alarming when it’s your own design that is being accused of having been backdoored. Claiming the NSA colluded with intel to backdoor RdRand is also to accuse me personally of having colluded with the NSA in producing a subverted design. I did not.

A quick googling revealed many such instances of statements to this effect, strewn across the internet, based on inferences from the Snowden leaks and resulting Guardian and NYT articles.

I personally know it not to be true and from my perspective, the effort we went to improve computer security by making secure random numbers available and ubiquitous in a low attack-surface model is now being undermined by speculation that would lead people to use less available, less secure RNGs. This I expect would serve the needs of the NSA well.

Firstly, an honest person does not tell us that it is hurtful that his integrity is doubted, since that is an effort to shut down discussion.  An honest person instead provides evidence of his integrity.  A dishonest person wants to shut down discussion.  An honest person wants discussion of the truth told his way.

Secondly, an honest person would not tell us that any doubt of RDRAND is doubt in his integrity, since Snowden has just revealed that the NSA has been subverting cryptography with secret agents acting behind the scenes.  He would instead tell us that that part of the system of which he has knowledge has not been subverted in ways he can detect, that if RDRAND has been subverted, it has been subverted by a secret agent playing clever tricks behind his back.  An honest person concerned for his good name would avoid the risk of taking the blame for furtive acts done by secret agents.

Thirdly, an honest person would spontaneously and unprompted provide some innocent explanation for the strange and suspicious looking design decision to whiten RDRAND on chip.

Suppose you see some people showing up at your neighbor’s house while your neighbors are away.  You go out to see what is up.  If they immediately and spontaneously start explaining what is going on, probably innocent.  If they cry indignantly that it is outrageous that you act as if this is suspicious behavior, they are guilty as hell.

When David Johnston starts off by saying how hurtful it is to doubt him, rather than “We chose to whiten on chip because …”, that is like the Wizard of Oz saying “ignore the man behind the curtain”.

From which I conclude that David Johnston, one of the designers of RDRAND, is as guilty as hell.