Exclusive: NSA infiltrated RSA security more deeply than thought - study
(Reuters) - Security industry pioneer RSA adopted not just one but two encryption tools developed by the U.S. National Security Agency, greatly increasing the spy agency's ability to eavesdrop on some Internet communications …
Context & Ripple Effects
The arc here began in December 2013, when Reuters reported RSA had received $10 million to make an NSA-designed algorithm the default in its BSafe crypto toolkit. RSA publicly categorically denied any secret agreement with the agency, while Wired asked how much ordinary users should actually worry. The denial framed the payment as a routine licensing deal rather than a deliberate weakening.
This study cuts the ground from under that framing: it finds BSafe carried not one but two NSA-developed encryption tools, materially widening the agency's eavesdropping surface inside a product sold by one of the security industry's most trusted names. The pickup by Gigaom alongside the original reporting shows the story travelling beyond the security press into mainstream tech coverage.
First-order effects
- Enterprise customers relying on BSafe for encrypted communications must now re-evaluate whether their vendor's flagship toolkit was engineered for interception, directly undermining the trust position RSA defended in its December denial.
Second-order effects
- Rival security vendors can now compete on provenance — non-US and open implementations of encryption primitives become a selling point against American suppliers tainted by NSA collaboration.
Third-order effects
- If the pattern holds, the Snowden-era disclosures push the industry toward independently reviewed cryptographic standards and away from vendor-blessed defaults, restructuring who is trusted to design the internet's encryption layer.
The trend: Post-Snowden revelations are systematically eroding trust in NSA-influenced commercial cryptography, shifting buyers toward independently audited and non-US encryption stacks.