Everyone has more or less agreed that the 2006 NIST standard for random number generators includes an algorithm that was likely back-doored by the NSA. The upside was that the algorithm was not particularly attractive, and it was likely that most people chose one of the other alternative algorithms. Plus, even before the NSA revelations, researchers in 2007 started pointing out why there were some flaws and this algorithm should probably be avoided.
Fast forward to today, and RSA (a major security company) has announced that the suspect algorithm is the default choice in their security products, and recommends that their customers take special steps to change that default now.
There’s two ways I think we can take this…
1) RSA is not as smart as we thought, especially since they claim the choice to make this a default was originally made “on the basis of providing the best security for our customers”.
2) RSA made this the default algorithm due to pressure from the NSA as part of the NSA’s admitted program to influence commercial crypto products.
If it’s #1, this is a sad day, because RSA is a giant in the security field.
If it’s #2, you have to take this announcement from RSA as an implicit admission that they compromised their customers’ security as a favor to the US Gov’t. This is not without irony, as many of their customers are OTHER parts of the US Gov’t, who depend on RSA products to keep us safe from foreign adversaries.