How Worried Should We Be About the Alleged RSA-NSA Scheming?
A Reuters news story published a week ago raised disturbing questions about the relationship between the NSA and RSA Security (now a division of EMC), a prominent vendor of cryptographic technologies.
Context & Ripple Effects
The Reuters report that RSA Security took $10 million to make an NSA-backdoored algorithm the default in its BSafe crypto software landed ten days ago, and the fallout has moved fast: RSA issued a categorical denial of any secret agreement two days later, and F-Secure's Mikko Hypponen pulled out of his RSA Conference keynote in protest. Wired's piece is an assessment piece at the end of that week, weighing how much the allegations actually matter given what else has surfaced.
The story sits inside a dense December of NSA disclosures: leaked documents confirming mass phone-record collection, Judge Pauley's ruling that the dragnet is lawful, and Chaos Communications Congress presentations on the Tailored Access Operations unit intercepting hardware shipments and hijacking Wi-Fi at range. Against that backdrop, the question is no longer whether the NSA seeks access — it is whether commercial cryptography vendors are part of the supply chain.
First-order effects
- RSA and parent EMC face immediate trust damage on their core product: enterprise customers running BSafe must now decide whether to keep trusting vendor-chosen defaults whose provenance Reuters says was bought for $10 million.
Second-order effects
- Other security vendors will be pushed to prove their algorithms and standards work is free of intelligence-agency influence, making transparency about cryptographic choices a competitive differentiator rather than an academic nicety.
Third-order effects
- If buyers conclude that US-government-influenced defaults cannot be trusted, demand shifts toward openly specified, publicly vetted cryptography — a structural split between vendors whose algorithms carry agency fingerprints and those that can document they do not.
The trend: The post-Snowden disclosure stream is turning cryptography from a standards-trust market into a provenance-audit market, where every vendor default now carries an implicit question about who influenced it.