cryptogon.com

But today there’s an even bigger stink brewing around Dual_EC_DRBG. In an informal presentation (.pdf) at the CRYPTO 2007 conference in August, Dan Shumow and Niels Ferguson showed that the algorithm contains a weakness that can only be described a backdoor.

This is how it works: There are a bunch of constants — fixed numbers — in the standard used to define the algorithm’s elliptic curve. These constants are listed in Appendix A of the NIST publication, but nowhere is it explained where they came from.

What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.

The researchers don’t know what the secret numbers are. But because of the way the algorithm works, the person who produced the constants might know; he had the mathematical opportunity to produce the constants and the secret numbers in tandem.

Of course, we have no way of knowing whether the NSA knows the secret numbers that break Dual_EC-DRBG. We have no way of knowing whether an NSA employee working on his own came up with the constants — and has the secret numbers. We don’t know if someone from NIST, or someone in the ANSI working group, has them. Maybe nobody does.

We don’t know where the constants came from in the first place. We only know that whoever came up with them could have the key to this backdoor. And we know there’s no way for NIST — or anyone else — to prove otherwise.

In some cases, judges have granted the requests without requiring the government to demonstrate that there is probable cause to believe that a crime is taking place or that the inquiry will yield evidence of a crime. Privacy advocates fear such a practice may expose average Americans to a new level of government scrutiny of their daily lives.

Such requests run counter to the Justice Department’s internal recommendation that federal prosecutors seek warrants based on probable cause to obtain precise location data in private areas. The requests and orders are sealed at the government’s request, so it is difficult to know how often the orders are issued or denied.

The issue is taking on greater relevance as wireless carriers are racing to offer sleek services that allow cellphone users to know with the touch of a button where their friends or families are. The companies are hoping to recoup investments they have made to meet a federal mandate to provide enhanced 911 (E911) location tracking. Sprint Nextel, for instance, boasts that its “loopt” service even sends an alert when a friend is near, “putting an end to missed connections in the mall, at the movies or around town.”

With Verizon’s Chaperone service, parents can set up a “geofence” around, say, a few city blocks and receive an automatic text message if their child, holding the cellphone, travels outside that area.

Credit-default swaps, contracts designed to protect investors against default and used to speculate on credit quality, led the increase, expanding 49 percent to cover a notional $43 trillion of debt in the six months ended June 30, the BIS said in a report published late yesterday.

Derivatives of debt, currencies, commodities, stocks and interest rates rose 25 percent from the previous six months, the biggest jump since the Basel, Switzerland-based bank began compiling the data. Investors have been turning to credit derivatives as a way to speculate on a growing risk of defaults amid record U.S. mortgage foreclosures.

“The pace of increase in the credit segment outstripped the rises in other risk categories,” Christian Upper, a BIS analyst in Basel, wrote in the report. Credit-default swaps are “the dominant instrument,” accounting for 88 percent of credit derivatives, the BIS said.

The currency headed for its biggest weekly decline against the euro in a year as traders raised bets that the Fed will lower borrowing costs on Dec. 11. The yen headed for a weekly gain against the dollar as concern turmoil in credit markets will slow global growth spurred investors to sell higher- yielding assets bought with money borrowed in Japan.

The files listed the nationalities and biographical details of more than 700 fighters who crossed into Iraq from August last year, around half of whom came to the country to be suicide bombers, the New York Times reported today.

In all, 305, or 41%, of the fighters listed were from Saudi Arabia. Another 137, or 18%, came from Libya. Both countries are officially US allies in anti-terrorism efforts.

In contrast, 56 Syrians were listed and no Lebanese. Previously, US officials estimated that around a fifth of all foreign fighters in Iraq came from these two countries.

US officials have also long complained about Iranian interference in the affairs of its neighbour, accusing Tehran of shipping weapons for militants over the border. However, any assistance does not appear to extend to people, the paper said, reporting that, of around 25,000 suspected militants in US custody in Iraq, 11 were Iranian. No Iranians were listed among the fighters whose details were found.

The information came from files and computers seized in September when US forces raided a camp in the desert near Sinjar, a small town in north-west Iraq, close to the Syrian border. It was believed the camp was the base for an insurgent cell responsible for smuggling the vast majority of foreign fighters into Iraq.

The report evaluates eleven articles previously published in toxicology and pathology journals. In six of the articles, between 0.8% and 10.2% of laboratory mice and rats developed malignant tumors around or adjacent to the microchips. Two additional articles reported microchip-related cancer in dogs.

For decades, one investment bank in Lower Manhattan has churned out a golden list of corporate executives and statesmen, wealthy financiers and nonprofit managers.

In many ways, Goldman Sachs is seen as the financial world’s equivalent of General Electric, the corporate powerhouse, or McKinsey & Company, the management consulting firm. It is a training ground — and finishing school —from which other companies, along with quite a few governments, have frequently plucked their own top leaders.

And it has seeded some of the most successful private investment funds, many of them extending Goldman’s shadow from Greenwich, Conn., to London and beyond.

Goldman claims among its alumni Henry M. Paulson Jr., the current Treasury secretary; Robert E. Rubin, a Treasury secretary under President Bill Clinton and now Citigroup’s chairman; and Mario Draghi, the Bank of Italy’s governor. Jon S. Corzine, New Jersey’s governor, led Goldman for several years. Joshua B. Bolten, the current White House chief of staff, is a Goldman alum.

Mr. Thain, who left Goldman as president and chief operating officer to take over the troubled New York Stock Exchange and now Merrill, falls squarely in that tradition.

To insiders, all this is a result of Goldman’s elite culture, a sense of close-knit partnership that has endured despite the firm’s decision in 1999 to turn itself into a publicly owned corporation. To detractors, the firm is alternately a cult or a secretive fraternity like Skull and Bones at Yale, one focused on profits and power.

The company yesterday said that it had hired Goldman Sachs and Lehman Brothers to tout for new funds that seemed likely to dilute existing shareholders, adding that it was also considering halving the dividend. Its shares lost more than a quarter of their value.

Along with Fannie Mae, Freddie Mac is an important prop to the US housing market, set up to help ensure that mortgage firms are willing to lend. It insures their mortgage payments or buys the mortgages from them and resells them in the financial markets, and it operates under a government guarantee that is supposed to ensure that it cannot go out of business.

The quid pro quo is that it operates under strict financial rules, many of which were tightened after an accounting scandal at the start of the decade. Regulators have demanded that it hoards 30 per cent more capital than the normal legal minimum, but the firm said yesterday it was close to falling below that level.