RSA received $10 million to use backdoored NSA algorithm by default in crypto software BSafe
Exclusive: Secret contract tied NSA and security industry pioneer — (Reuters) - As a key part of a campaign to embed encryption software that it could crack into widely used computer products …
Context & Ripple Effects
The Reuters exclusive lands mid-Snowden cycle: four days earlier the NSA's bulk telephone metadata program was reported facing a constitutional challenge, and former employees had begun giving insider accounts of agency policy. This report extends that arc from mass collection into commercial cryptography itself.
Per documents described by Reuters, the $10 million contract made an algorithm the NSA could crack the default in RSA's BSafe toolkit — software licensed into other vendors' products, so the default setting propagated well beyond RSA's own customer base. The pickup was unusually broad for a single-source scoop: Ars Technica, The Verge, CNET, TechCrunch, The Register, Techdirt, GeekWire and Gizmodo all carried it on or about the same day.
First-order effects
- Every vendor shipping BSafe with default settings inherited a deliberately weakened random-number generator overnight; their immediate exposure is cryptographic, not reputational, until they change the default or strip the algorithm out.
- RSA faces a direct credibility test with two constituencies at once — enterprise security buyers who rely on its tokens and toolkits, and the speaker community around its own conference, whose participation now carries protest risk.
Second-order effects
- Rival cryptography vendors gain a sales wedge built on provenance: 'our algorithms were never touched by the NSA' becomes a pitch line, pressuring the whole US security-software sector to document how its standards inputs were made.
- Procurement guidance at foreign governments and banks, already spooked by the surveillance disclosures, has fresh grounds to favor non-US or openly specified crypto — a pricing and market-access problem for American vendors that no single contract caused.
Third-order effects
- If secret payments to standard-setters and toolkit makers prove systemic rather than isolated, trust in NIST-originated algorithms migrates toward openly designed, internationally reviewed alternatives — a structural shift in who sets global crypto standards.
- The episode strengthens the case, already running through the Snowden coverage, for surveillance oversight reaching beyond bulk collection into the integrity of commercial security products themselves.
The trend: The Snowden-era revelations are expanding from mass data collection into the supply chain of trust itself, with paid backdoors in widely licensed crypto marking the point where surveillance policy starts reshaping the global security-software market.