The Patching Friars' AlmanacA calendar of CVE saints

October 11

Dual_EC_DRBGHoly card for dual-ec-drbg, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 Dual_EC_DRBG ALEA IAM SCITA EST
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Dual_EC_DRBG, of Suspicious Randomness

Patron of random number generators with mysterious constants, standards written in good company, and suspicious cryptographers.

Life

Standardised by NIST in 2006, the Dual_EC_DRBG generator was slow, and as early as 2007 Dan Shumow and Niels Ferguson warned that whoever knew the relation between its points P and Q could predict its output. In 2013 the Snowden documents suggested the NSA had a hand in it, and it turned out to be the default generator in RSA's BSAFE library. NIST withdrew it from its standards soon after.

Prayer

O Saint Dual_EC_DRBG, who rolls the dice already knowing the result, deliver us from constants whose origin nobody explains. Amen.

How to celebrate

Celebrated by using a modern generator such as HMAC_DRBG or CTR_DRBG and asking, before every constant, "who chose this?".

Technical record

Disclosed on
October 11 2013
CVE
CVE-2007-6755

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.

Sources: nvd.nist.gov

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.