Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Isn't this the case for almost any cryptosystem? There's JP Aumasson's paper on the possibility of hash backdoor: http://www.131002.net/data/papers/Aum11a.pdf


Not for RSA. It's highly unlikely that anyone has hidden a backdoor in the set of primes. They'd have to solve the RSA problem, which is believed to be difficult.

When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria.

Edit: these is also called "nothing up my sleeve numbers".


There are methods of embedding backdoors into the RSA key generation scheme, though (e.g. http://crypto.cs.mcgill.ca/~crepeau/PDF/CS02.pdf).

When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria.

The initialization constant in SipHash is awesome: "somepseudorandomlychosenbytes".


Right, but that would be a backdoor in that particular implementation. If you implement RSA yourself, you're safe from backdoors. (With the usual caveats about compilers, operating system and hardware.) The insidious thing about cryptographic backdoors is that they're embedded in the specification itself. Any conforming implementation will be vulnerable.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: