Could the NSA have a secret exploit for Bitcoins? It's probably obvious that the cryptocurrency provides a very strong financial incentive to break its encryption, given that such a vulnerability could allow an attacker to get their hands on millions. But another strong incentive for intelligence agencies is that by decrypting it, they can control and monitor its use.
Last week, we learned that the National Security Agency, with its aggressive policy, has “broken” the most widely used encryption technologies on the Internet. The agency justifies its actions by simply stating that it has to do its job. There is speculation that many protocols or crypto implementations have been hacked, or have been intentionally weakened, or operate with backdoors open to the NSA. In this way, the NSA is everywhere, perhaps even in Bitcoin, which until now we thought protected our privacy.
[ads2]
Bitcoin is an open source encrypted currency, a peer-to-peer (decentralized) electronic cash system. It is also the most powerful distributed computing program in the world. However we describe it, it is under government control.
Earlier this year, the US Financial Crimes Enforcement Network (part of the Financial Crimes Enforcement Network, or FinCEN) issued guidelines on virtual currencies. Many in the Bitcoin community see it as an attempt to demarcate it.
Bitcoin has recently come under the scrutiny of the New York Department of Financial Services, the California Department of Financial Institutions, and the Bank of Thailand. Additionally, the U.S. House Committee on Homeland Security and Governmental Affairs recently sent a letter to the U.S. Department of Homeland Security requesting information on what it intends to do with Bitcoin.
Clearly, Bitcoin is now on the government’s radar. Given the NSA’s actions, and its relationship with crypto, what can you think about Bitcoin?
Let’s look at how the Bitcoin system works.
Bitcoin uses a clever mix of two concepts: hashing and digital signatures. Hash functions typically create fixed-length data that is unique, while digital signatures are used to verify the authenticity of a digital message or file. The integrity of the Bitcoin blockchain for consensus transactions depends on a hash function called SHA-256, which was designed by the NSA and published by the National Institute of Standards and Technology (NIST).
Cryptography researcher Matthew D. Green of Johns Hopkins University said: “If we assume that the NSA did something to SHA-256 that a researcher cannot detect, it would have the undetectable ability to create transactions. It’s really scary if someone has a way to read SHA-256 quickly without having to brute-force it because that way they can take control of the network.”
Elliptic Curve Digital Signature Algorithm (ECDSA) digital signatures are used to validate changes in ownership of the currency. A theoretical weakness in ECDSA could allow for faster recovery of private keys, allowing attackers to steal Bitcoins, but only from those who reuse their wallet addresses, Motherboard Vice reports. Bitcoin developer Gregory Maxwell said that attacks exploiting these weaknesses can be detected almost immediately, and that he could develop an algorithm to replace ECDSA in about a month. But the problems with SHA-256 are likely to be more serious, as “we can’t replace it in a compatible way,” he said.
A weak random number generator (RNG) poses security problems in Bitcoin, such as the case of an Android vulnerability last month. RNGs that deal with the random generation of encryption numbers, if the numbers they produce are not that random or predictable then there is a big problem.
Now for the best part.
A random number generator designed by the NSA, Dual_EC_DRBG, has now been confirmed to have a backdoor.
Do you still feel safe?
Many academic analyses have shown that Bitcoin wallet addresses can indicate the identities of their owners.
