RSA categorically denies it entered into secret agreement with NSA to weaken its security
RSA RESPONSE TO MEDIA CLAIMS REGARDING NSA RELATIONSHIP — Recent press coverage has asserted that RSA entered into a “secret contract” with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries.
Context & Ripple Effects
Two days after Reuters reported that RSA took $10 million from the NSA to make a backdoored algorithm the default in its BSAFE encryption libraries — a claim corroborated by follow-on coverage at Ars Technica and syndication across eight-plus outlets including Schneier on Security and Gigaom — RSA has issued a categorical denial on its own blog. The wording matters: RSA denies a "secret contract" and any knowing weakening of BSAFE, while Gigaom's framing of the same statement notes the company is not denying that NSA money changed hands.
That distinction is where the story now sits: the $10 million payment and the default-setting of the flawed generator are treated as confirmed in the reporting on record, while RSA contests only intent and secrecy. With the denial arriving via blog post rather than document disclosure, the dispute turns on what RSA knew about the algorithm's weakness versus what it was paid.
First-order effects
- RSA faces an immediate credibility test with enterprise customers of BSAFE, whose encryption defaults are now publicly tied to a confirmed $10 million NSA payment even as the company denies wrongdoing.
- RSA's denial narrows the argument to knowledge rather than money — press outlets are already highlighting that the company does not dispute receiving NSA cash, keeping the story alive through the holiday news lull.
Second-order effects
- Security vendors competing with RSA can position their own toolkits around independently vetted random number generation, turning trust in provenance into a sales differentiator against BSAFE-embedded products.
- Standards bodies and cryptography researchers face pressure to formally review or deprecate the disputed generator wherever it ships by default, since vendor assurances alone no longer settle the question for buyers.
Third-order effects
- If the pattern of paid defaults holds, US-origin commercial encryption software faces a structural trust deficit abroad, pushing procurement toward open implementations and non-US vendors.
- The episode strengthens the case for separating cryptographic standard-setting from intelligence funding, a governance shift regulators and international standards groups were already weighing amid broader NSA disclosures.
The trend: The Snowden-era revelations are forcing commercial encryption vendors to defend not just their algorithms' strength but their revenue relationships with intelligence agencies.