The National Institute of Standards and Technology (NIST) has announced that it has removed the Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG) cryptographic algorithm from its draft guidance on random number generators.
Following a review period, the algorithm has been removed from draft guidance on random number generators, and recommended that current users of Dual_EC_DRBG transition to one of the three remaining approved algorithms as quickly as possible, NIST said.
NIST previously recommended against the use of the algorithm and reissued SP 800-90A for public comment, particularly as it was believed that the algorithm contained a weakness that would allow attackers to get access to the cryptographic keys and defeat the protections provided by them.
The algorithm came to prominence when it was noted that a number of security vendors were using this by default, including RSA, who told users to stop using the algorithm in September 2013, six years after it was found to have a backdoor which weakened the strength of any encryption that relied on it. In January, Dual_EC_DRBG patent holderBlackBerry defended the use of the algorithm saying that it did not consider the “backdoor” to be a vulnerability.
NIST advised federal agencies and other buyers of cryptographic products to ask vendors if their cryptographic modules rely on Dual_EC_DRBG, and if so, to ask their vendors to reconfigure those products to use alternative algorithms.
