The NSA's former research director has apologised for the body's endorsement of an insecure cryptography solution that was adopted by American businesses.
The NSA's support for the Dual Elliptic Curve Deterministic Random Bit Generator (Dual EC DRBG) was a key factor in the US National Institute of Standards and Technology (NIST) approving the tool as a trustworthy solution throughout the 2000s, encouraging businesses to use the system.
It was integrated into RSA Security's BSAFE toolkits, alongside others'.
However, researchers have since found plenty of backdoors allowing hackers to siphon off and decrypt data, rendering the tool useless.
The NSA's former research director, Michael Wertheimer, wrote in a letter published by the American Mathematical Society: "With hindsight, the NSA should have ceased supporting the Dual EC DRBG algorithm immediately after security researchers discovered the potential for a trapdoor.
"In truth, I can think of no better way to describe our failure to drop support for the Dual EC DRBG algorithm as anything other than regrettable."
The flaw was exposed by former government contractor Edward Snowden in 2013 in leaked documents and as a result, NIST removed the tool from its approved list in 2014.
"The costs to the Defense Department to deploy a new algorithm were not an adequate reason to sustain our support for a questionable algorithm," Wertheimer continued.
"Indeed, we support NIST's April 2014 decision to remove the algorithm. Furthermore, we realise that our advocacy for the Dual EC DRBG casts suspicion on the broader body of work the NSA has done to promote secure standards."
To add more fuel to the fire, it later came to light that the NSA may have paid RSA $10m to integrate its security solution into the software, although neither the NSA nor RSA have officially confirmed this.
Wertheimer was the NSA's research director from May 2010 until September 2014, according to his LinkedIn profile.
-
How the UK MoJ achieved secure networks for prisons and offices with Palo Alto NetworksCase study Adopting zero trust is a necessity when your own users are trying to launch cyber attacks
-
Putting small language models under the microscopeITPro Podcast The benefits of small language models are undeniable – but they're no silver bullet
-
NSA issues guidance on encrypted DNS usageNews The US National Security Agency warns enterprises not to use third-party DNS resolvers
-
If you're surprised the NSA can hack your computer, you need a reality checkOpinion We’ve reached a situation where OSes are so complex, they're impossible to secure
-
Shadow Broker exploit dumps five million cyber attacksNews Kaspersky: Hacking tool leaks fuel cyber criminal activity
-
The NSA is sharing projects on GitHub
News Some of the projects are outdated, but could prove useful to some open source developers
-
Juniper Networks to ditch alleged NSA eavesdropping codeNews New security systems without the code will be shipped in first half of this year
-
AT&T and NSA collaborated on "vast" surveillance programNews Documents reveal the two organisations have been working together for decades
-
NSA phone spying was illegal, rules US courtNews Patriot Act does not cover bulk data collection, says Court of Appeals
-
Edward Snowden awarded three-year Russian permitNews The former US intelligence contractor is working in an IT-related job, although he has a modest living
