Kleptography: Difference between revisions

Content deleted Content added

Inline

Revision as of 21:07, 28 June 2023

Kleptography is the study of stealing information securely and subliminally. The term was introduced by Adam Young and Moti Yung in the Proceedings of Advances in Cryptology—Crypto '96.^[1] Kleptography is a subfield of cryptovirology and is a natural extension of the theory of subliminal channels that was pioneered by Gus Simmons while at Sandia National Laboratory.^[2]^[3]^[4] A kleptographic backdoor is synonymously referred to as an asymmetric backdoor. Kleptography encompasses secure and covert communications through cryptosystems and cryptographic protocols. This is reminiscent of, but not the same as steganography that studies covert communications through graphics, video, digital audio data, and so forth.

Kleptographic attack

Meaning

A kleptographic attack is an attack which uses asymmetric cryptography to implement a cryptographic backdoor.^[5] For example, one such attack could be to subtly modify how the public and private key pairs are generated by the cryptosystem so that the private key could be derived from the public key using the attacker's private key. In a well-designed attack, the outputs of the infected cryptosystem would be computationally indistinguishable from the outputs of the corresponding uninfected cryptosystem.^[6]^[7] If the infected cryptosystem is a black-box implementation such as a hardware security module, a smartcard, or a Trusted Platform Module, a successful attack could go completely unnoticed.

A reverse engineer might be able to uncover a backdoor inserted by an attacker, and when it is a symmetric backdoor, even use it themself.^[5] However, by definition a kleptographic backdoor is asymmetric and the reverse-engineer cannot use it. A kleptographic attack (asymmetric backdoor) requires a private key known only to the attacker in order to use the backdoor. In this case, even if the reverse engineer was well-funded and gained complete knowledge of the backdoor, it would remain useless for them to extract the plaintext without the attacker's private key.^[5]

Construction

Kleptographic attacks can be constructed as a cryptotrojan that infects a cryptosystem and opens a backdoor for the attacker, or can be implemented by the manufacturer of a cryptosystem. The attack does not necessarily have to reveal the entirety of the cryptosystem's output; a more complicated attack technique may alternate between producing uninfected output and insecure data with the backdoor present.^[8]

Design

Kleptographic attacks have been designed for RSA key generation, the Diffie–Hellman key exchange, the Digital Signature Algorithm, and other cryptographic algorithms and protocols.^[8] SSL, SSH, and IPsec protocols are vulnerable to kleptographic attacks.^[9] In each case, the attacker is able to compromise the particular cryptographic algorithm or protocol by inspecting the information that the backdoor information is encoded in (e.g., the public key, the digital signature, the key exchange messages, etc.) and then exploiting the logic of the asymmetric backdoor using their secret key (usually a private key).

A. Juels and J. Guajardo^[10] proposed a method (KEGVER) through which a third party can verify RSA key generation. This is devised as a form of distributed key generation in which the secret key is only known to the black box itself. This assures that the key generation process was not modified and that the private key cannot be reproduced through a kleptographic attack.^[10]

Examples

Four practical examples of kleptographic attacks (including a simplified SETUP attack against RSA) can be found in JCrypTool 1.0,^[11] the platform-independent version of the open-source CrypTool project.^[12] A demonstration of the prevention of kleptographic attacks by means of the KEGVER method is also implemented in JCrypTool.

The Dual_EC_DRBG cryptographic pseudo-random number generator from the NIST SP 800-90A is thought to contain a kleptographic backdoor. Dual_EC_DRBG utilizes elliptic curve cryptography, and NSA is thought to hold a private key which, together with bias flaws in Dual_EC_DRBG, allows NSA to decrypt SSL traffic between computers using Dual_EC_DRBG for example.^[13] The algebraic nature of the attack follows the structure of the repeated Dlog Kleptogram in the work of Young and Yung.

References

^ Young, A.; Yung, M. (1996). "The Dark Side of Black-Box Cryptography, or: Should we trust Capstone?". In Koblitz, Neal (ed.). Advances in Cryptology — CRYPTO ’96: 16th Annual International Cryptology Conference, Santa Barbara, California, USA, August 18–22, 1996, Proceedings. Lecture Notes in Computer Science. Springer Berlin Heidelberg. pp. 89–103. ISBN 978-3-540-68697-2.
^ Simmons, G. J. (1984). "The Prisoners' Problem and the Subliminal Channel". In Chaum, D. (ed.). Proceedings of Crypto '83. Plenum Press. pp. 51–67. doi:10.1007/978-1-4684-4730-9_5. ISBN 978-1-4684-4732-3.
^ Simmons, G. J. (1985). "The Subliminal Channel and Digital Signatures". In Beth, T.; Cot, N.; Ingemarsson, I. (eds.). Proceedings of Eurocrypt '84. Springer-Verlag. pp. 364–378. doi:10.1007/3-540-39757-4_25. ISBN 978-3-540-16076-2.
^ Simmons, G. J. (1993). "Subliminal Communication is Easy Using the DSA". In Helleseth, T. (ed.). Proceedings of Eurocrypt '93. Springer-Verlag. pp. 218–232. doi:10.1007/3-540-48285-7_18. ISBN 978-3-540-57600-6.
^ ^a ^b ^c Esslinger, Bernhard; Vacek, Patrick (20 February 2013). "The Dark Side of Cryptography: Kleptography in Black-Box Implementations". Infosecurity Magazine. Infosecurity Magazine. Retrieved 18 March 2014.
^ Young, Adam (2006). "Cryptovirology FAQ". Cryptovirology.com. Archived from the original on 9 May 2017. Retrieved 18 March 2014.
^ Easttom, Chuck (May 2018). "A Study of Cryptographic Backdoors in Cryptographic Primitives". Iranian Conference on Electrical Engineering: 1664–1669. doi:10.1109/ICEE.2018.8472465. ISBN 978-1-5386-4914-5. S2CID 52896242.
^ ^a ^b Young, A.; Yung, M. (2004). Malicious Cryptography: Exposing Cryptovirology. Wiley. ISBN 978-0-7645-6846-6.
^ "Bezpieczeństwo protokołów SSL/TLS i SSL w kontekście ataków kleptograficznych" [Security of SSL/TLS and SSL protocols in the context of kleptographic attacks]. kleptografia.im.pwr.wroc.pl (in Polish). Archived from the original on 2006-04-23. {{cite web}}: Cite uses deprecated parameter |authors= (help)
^ ^a ^b Juels, Ari; Guajardo, Jorge (2002). "RSA Key Generation with Verifiable Randomness" (PDF). In Naccache, D.; Pallier, P. (eds.). Public Key Cryptography: 4th International Workshop on Practice and Theory in Public Key Cryptosystems. Springer Berlin Heidelberg. p. 357–374. doi:10.1007/3-540-45664-3_26. ISBN 978-3-540-43168-8. ISSN 0302-9743. Archived from the original (PDF) on 2013-05-12.
^ https://github.com/jcryptool JCrypTool project website
^ Esslinger, B. (2010). "Die dunkle Seite der Kryptografie - Kleptografie bei Black-Box-Implementierungen". <kes> (in German). No. 4. p. 6. Archived from the original on 2011-07-21.{{cite magazine}}: CS1 maint: extra punctuation (link)
^ Green, Matthew (September 18, 2016). "The Many Flaws of Dual_EC_DRBG". Retrieved November 19, 2016.

[yy96-1] Young, A.; Yung, M. (1996). "The Dark Side of Black-Box Cryptography, or: Should we trust Capstone?". In Koblitz, Neal (ed.). Advances in Cryptology — CRYPTO ’96: 16th Annual International Cryptology Conference, Santa Barbara, California, USA, August 18–22, 1996, Proceedings. Lecture Notes in Computer Science. Springer Berlin Heidelberg. pp. 89–103. ISBN 978-3-540-68697-2.

[si84-2] Simmons, G. J. (1984). "The Prisoners' Problem and the Subliminal Channel". In Chaum, D. (ed.). Proceedings of Crypto '83. Plenum Press. pp. 51–67. doi:10.1007/978-1-4684-4730-9_5. ISBN 978-1-4684-4732-3.

[si85-3] Simmons, G. J. (1985). "The Subliminal Channel and Digital Signatures". In Beth, T.; Cot, N.; Ingemarsson, I. (eds.). Proceedings of Eurocrypt '84. Springer-Verlag. pp. 364–378. doi:10.1007/3-540-39757-4_25. ISBN 978-3-540-16076-2.

[si93-4] Simmons, G. J. (1993). "Subliminal Communication is Easy Using the DSA". In Helleseth, T. (ed.). Proceedings of Eurocrypt '93. Springer-Verlag. pp. 218–232. doi:10.1007/3-540-48285-7_18. ISBN 978-3-540-57600-6.

[infosecurity-5] Esslinger, Bernhard; Vacek, Patrick (20 February 2013). "The Dark Side of Cryptography: Kleptography in Black-Box Implementations". Infosecurity Magazine. Infosecurity Magazine. Retrieved 18 March 2014.

[6] Young, Adam (2006). "Cryptovirology FAQ". Cryptovirology.com. Archived from the original on 9 May 2017. Retrieved 18 March 2014.

[7] Easttom, Chuck (May 2018). "A Study of Cryptographic Backdoors in Cryptographic Primitives". Iranian Conference on Electrical Engineering: 1664–1669. doi:10.1109/ICEE.2018.8472465. ISBN 978-1-5386-4914-5. S2CID 52896242.

[yy04-8] Young, A.; Yung, M. (2004). Malicious Cryptography: Exposing Cryptovirology. Wiley. ISBN 978-0-7645-6846-6.

[9] "Bezpieczeństwo protokołów SSL/TLS i SSL w kontekście ataków kleptograficznych" [Security of SSL/TLS and SSL protocols in the context of kleptographic attacks]. kleptografia.im.pwr.wroc.pl (in Polish). Archived from the original on 2006-04-23. {{cite web}}: Cite uses deprecated parameter |authors= (help)

[jg02-10] Juels, Ari; Guajardo, Jorge (2002). "RSA Key Generation with Verifiable Randomness" (PDF). In Naccache, D.; Pallier, P. (eds.). Public Key Cryptography: 4th International Workshop on Practice and Theory in Public Key Cryptosystems. Springer Berlin Heidelberg. p. 357–374. doi:10.1007/3-540-45664-3_26. ISBN 978-3-540-43168-8. ISSN 0302-9743. Archived from the original (PDF) on 2013-05-12.

[11] ttps://github.com/jcryptool JCrypTool project website

[be10-12] Esslinger, B. (2010). "Die dunkle Seite der Kryptografie - Kleptografie bei Black-Box-Implementierungen". <kes> (in German). No. 4. p. 6. Archived from the original on 2011-07-21.{{cite magazine}}: CS1 maint: extra punctuation (link)

[13] Green, Matthew (September 18, 2016). "The Many Flaws of Dual_EC_DRBG". Retrieved November 19, 2016.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

@@ Line 1: / Line 1: @@
 {{Short description|Study of stealing information securely and subliminally}}
-'''Kleptography''' is the study of stealing information securely and subliminally. The term was introduced by Adam Young and [[Moti Yung]] in the Proceedings of Advances in Cryptology—Crypto '96.<ref name="yy96">A. Young, [[Moti Yung|M. Yung]], "The Dark Side of Black-Box Cryptography, or: Should we trust Capstone?" In Proceedings of Crypto '96, [[Neal Koblitz]] (Ed.), Springer-Verlag, pages 89–103, 1996.</ref>
+'''Kleptography''' is the study of stealing information securely and subliminally. The term was introduced by Adam Young and [[Moti Yung]] in the Proceedings of Advances in Cryptology—Crypto '96.<ref name="yy96">{{cite book | editor-last=Koblitz | editor-first=Neal |editor-link=Neal Koblitz| title=Advances in Cryptology — CRYPTO ’96: 16th Annual International Cryptology Conference, Santa Barbara, California, USA, August 18–22, 1996, Proceedings | publisher=Springer Berlin Heidelberg | series=Lecture Notes in Computer Science | year=1996 | isbn=978-3-540-68697-2 | chapter-url=https://books.google.com/books?id=9lurCAAAQBAJ&pg=PA89 | pages=89–103 |chapter=The Dark Side of Black-Box Cryptography, or: Should we trust Capstone? |first1=A. |last1=Young |author-link2=Moti Yung|first2=M. |last2=Yung}}</ref>
-Kleptography is a subfield of [[cryptovirology]] and is a natural extension of the theory of [[subliminal channels]] that was pioneered by [[Gustavus Simmons|Gus Simmons]] while at [[Sandia National Laboratory]].<ref name="si84">[[Gustavus Simmons|G. J. Simmons]], "The Prisoners' Problem and the Subliminal Channel," In Proceedings of Crypto '83, D. Chaum (Ed.), pages 51–67, Plenum Press, 1984.</ref><ref name="si85">G. J. Simmons, "The Subliminal Channel and Digital Signatures," In Proceedings of Eurocrypt '84, T. Beth, N. Cot, I. Ingemarsson (Eds.), pages 364-378, Springer-Verlag, 1985.</ref><ref name="si93">G. J. Simmons, "Subliminal Communication is Easy Using the DSA," In proceedings of Eurocrypt '93, T. Helleseth (Ed.), pages 218-232, Springer-Verlag, 1993.</ref> A kleptographic backdoor is synonymously referred to as an asymmetric backdoor.  Kleptography encompasses secure and covert communications through cryptosystems and cryptographic protocols. This is reminiscent of, but not the same as [[steganography]] that studies covert communications through graphics, video, digital audio data, and so forth.
+Kleptography is a subfield of [[cryptovirology]] and is a natural extension of the theory of [[subliminal channels]] that was pioneered by [[Gustavus Simmons|Gus Simmons]] while at [[Sandia National Laboratory]].<ref name="si84">{{cite book |author-link=Gustavus Simmons|first=G. J. |last=Simmons |chapter=The Prisoners' Problem and the Subliminal Channel |title=Proceedings of Crypto '83 |editor-first=D. |editor-last=Chaum |pages=51–67 |publisher=Plenum Press |year=1984 | isbn=978-1-4684-4732-3 | doi=10.1007/978-1-4684-4730-9_5}}</ref><ref name="si85">{{cite book |first=G. J. |last=Simmons |chapter=The Subliminal Channel and Digital Signatures |title=Proceedings of Eurocrypt '84 |editor-first1=T. |editor-last1=Beth |editor-first2=N. |editor-last2=Cot |editor-first3=I. |editor-last3=Ingemarsson |pages= 364-378 |publisher=Springer-Verlag |year=1985 | isbn=978-3-540-16076-2 | doi=10.1007/3-540-39757-4_25}}</ref><ref name="si93">{{cite book |first=G. J. |last=Simmons |chapter=Subliminal Communication is Easy Using the DSA |title=Proceedings of Eurocrypt '93 |editor-first=T. |editor-last=Helleseth |pages= 218-232 |publisher=Springer-Verlag |year=1993 | isbn=978-3-540-57600-6 | doi=10.1007/3-540-48285-7_18}}</ref> A kleptographic backdoor is synonymously referred to as an asymmetric backdoor.  Kleptography encompasses secure and covert communications through cryptosystems and cryptographic protocols. This is reminiscent of, but not the same as [[steganography]] that studies covert communications through graphics, video, digital audio data, and so forth.
 ==Kleptographic attack==
 ===Meaning===
-A kleptographic attack is an attack which uses [[asymmetric cryptography]] to implement a cryptographic [[backdoor (computing)|backdoor]].<ref>{{cite web |url=http://www.infosecurity-magazine.com/view/30852/the-dark-side-of-cryptography-kleptography-in-blackbox-implementations/ |title=The Dark Side of Cryptography: Kleptography in Black-Box Implementations |last1=Esslinger |first1=Bernhard |last2=Vacek |first2=Patrick |publisher=Infosecurity Magazine |date=20 February 2013 |website=Infosecurity Magazine |accessdate=18 March 2014}}</ref> For example, one such attack could be to subtly modify how the [[public-key cryptography|public and private key pairs]] are generated by the cryptosystem so that the private key could be derived from the public key using the attacker's private key. In a well-designed attack, the outputs of the infected cryptosystem would be [[computational indistinguishability|computationally indistinguishable]] from the outputs of the corresponding uninfected cryptosystem.<ref>{{cite web |url=http://www.cryptovirology.com/cryptovfiles/cryptovirologyfaqver1.html |title=Cryptovirology FAQ |last1=Young |first1=Adam |year=2006 |website=Cryptovirology.com |accessdate=18 March 2014 |archive-date=9 May 2017 |archive-url=https://web.archive.org/web/20170509070759/http://www.cryptovirology.com/cryptovfiles/cryptovirologyfaqver1.html |url-status=dead }}</ref><ref>{{cite journal |last1= Easttom |first1= Chuck|date= May 2018|title=A Study of Cryptographic Backdoors in Cryptographic Primitives |journal=Iranian Conference on Electrical Engineering|pages=1664–1669|doi= 10.1109/ICEE.2018.8472465|isbn= 978-1-5386-4914-5|s2cid= 52896242}}</ref> If the infected cryptosystem is a [[Black box|black-box]] implementation such as a [[hardware security module]], a [[smartcard]], or a [[Trusted Platform Module]], a successful attack could go completely unnoticed.
+A kleptographic attack is an attack which uses [[asymmetric cryptography]] to implement a cryptographic [[backdoor (computing)|backdoor]].<ref name=infosecurity>{{cite magazine|url=http://www.infosecurity-magazine.com/view/30852/the-dark-side-of-cryptography-kleptography-in-blackbox-implementations/ |title=The Dark Side of Cryptography: Kleptography in Black-Box Implementations |last1=Esslinger |first1=Bernhard |last2=Vacek |first2=Patrick |publisher=Infosecurity Magazine |date=20 February 2013 |magazine=Infosecurity Magazine |accessdate=18 March 2014}}</ref> For example, one such attack could be to subtly modify how the [[public-key cryptography|public and private key pairs]] are generated by the cryptosystem so that the private key could be derived from the public key using the attacker's private key. In a well-designed attack, the outputs of the infected cryptosystem would be [[computational indistinguishability|computationally indistinguishable]] from the outputs of the corresponding uninfected cryptosystem.<ref>{{cite web |url=http://www.cryptovirology.com/cryptovfiles/cryptovirologyfaqver1.html |title=Cryptovirology FAQ |last1=Young |first1=Adam |year=2006 |website=Cryptovirology.com |accessdate=18 March 2014 |archive-date=9 May 2017 |archive-url=https://web.archive.org/web/20170509070759/http://www.cryptovirology.com/cryptovfiles/cryptovirologyfaqver1.html |url-status=dead }}</ref><ref>{{cite journal |last1= Easttom |first1= Chuck|date= May 2018|title=A Study of Cryptographic Backdoors in Cryptographic Primitives |journal=Iranian Conference on Electrical Engineering|pages=1664–1669|doi= 10.1109/ICEE.2018.8472465|isbn= 978-1-5386-4914-5|s2cid= 52896242}}</ref> If the infected cryptosystem is a [[Black box|black-box]] implementation such as a [[hardware security module]], a [[smartcard]], or a [[Trusted Platform Module]], a successful attack could go completely unnoticed.
-A [[reverse engineering|reverse engineer]] might be able to uncover a backdoor inserted by an attacker, and when it is a symmetric backdoor, even use it themself.<ref>Esslinger, Bernhard; Vacek, Patrick, 2013, The Dark Side of Cryptography, "... manipulation of this sort could be revealed through reverse engineering ..."</ref> However, by definition a kleptographic backdoor is asymmetric and the reverse-engineer cannot use it. A kleptographic attack (asymmetric backdoor) requires a private key known only to the attacker in order to use the backdoor. In this case, even if the reverse engineer was well-funded and gained complete knowledge of the backdoor, it would remain useless for them to extract the plaintext without the attacker's private key.<ref>Esslinger, Bernhard; Vacek, Patrick, 2013, The Dark Side of Cryptography, "... sophisticated kleptographic attacks can indeed prevent [...] discovery."</ref>
+A [[reverse engineering|reverse engineer]] might be able to uncover a backdoor inserted by an attacker, and when it is a symmetric backdoor, even use it themself.<ref name=infosecurity /> However, by definition a kleptographic backdoor is asymmetric and the reverse-engineer cannot use it. A kleptographic attack (asymmetric backdoor) requires a private key known only to the attacker in order to use the backdoor. In this case, even if the reverse engineer was well-funded and gained complete knowledge of the backdoor, it would remain useless for them to extract the plaintext without the attacker's private key.<ref name=infosecurity />
 ===Construction===
-[[Kleptographic attack]]s can be constructed as a [[cryptotrojan]] that infects a cryptosystem and opens a backdoor for the attacker, or can be implemented by the manufacturer of a cryptosystem. The attack does not necessarily have to reveal the entirety of the cryptosystem's output; a more complicated attack technique may alternate between producing uninfected output and insecure data with the backdoor present.<ref name="yy04">A. Young, [[Moti Yung|M. Yung]], ''Malicious Cryptography: Exposing Cryptovirology'', John Wiley & Sons, 2004.</ref>
+[[Kleptographic attack]]s can be constructed as a [[cryptotrojan]] that infects a cryptosystem and opens a backdoor for the attacker, or can be implemented by the manufacturer of a cryptosystem. The attack does not necessarily have to reveal the entirety of the cryptosystem's output; a more complicated attack technique may alternate between producing uninfected output and insecure data with the backdoor present.<ref name="yy04">{{cite book | last=Young | first=A. | last2=Yung | first2=M. |author-link2=Moti Yung | title=Malicious Cryptography: Exposing Cryptovirology | publisher=Wiley | year=2004 | isbn=978-0-7645-6846-6}}</ref>
 ===Design===
-Kleptographic attacks have been designed for [[RSA (algorithm)|RSA]] key generation, the [[Diffie–Hellman key exchange]], the [[Digital Signature Algorithm]], and other cryptographic algorithms and protocols.<ref name="yy04" /> [[Secure Sockets Layer|SSL]], [[Secure Shell|SSH]], and [[IPsec]] protocols are vulnerable to [[kleptographic attack]]s.<ref>http://kleptografia.im.pwr.wroc.pl/ SSL attack by Filip Zagórski, and prof. Mirosław Kutyłowski</ref> In each case, the attacker is able to compromise the particular cryptographic algorithm or protocol by inspecting the information that the backdoor information is encoded in (e.g., the public key, the digital signature, the key exchange messages, etc.) and then exploiting the logic of the asymmetric backdoor using their secret key (usually a private key).
+Kleptographic attacks have been designed for [[RSA (algorithm)|RSA]] key generation, the [[Diffie–Hellman key exchange]], the [[Digital Signature Algorithm]], and other cryptographic algorithms and protocols.<ref name="yy04" /> [[Secure Sockets Layer|SSL]], [[Secure Shell|SSH]], and [[IPsec]] protocols are vulnerable to [[kleptographic attack]]s.<ref>{{cite web | title=Bezpieczeństwo protokołów SSL/TLS i SSL w kontekście ataków kleptograficznych |trans-title=Security of SSL/TLS and SSL protocols in the context of kleptographic attacks|authors=Filip Zagórski, and Prof. Mirosław Kutyłowski | website=kleptografia.im.pwr.wroc.pl | url=http://kleptografia.im.pwr.wroc.pl/ | archive-url=http://web.archive.org/web/20060423133130/http://kleptografia.im.pwr.wroc.pl/ | archive-date=2006-04-23 | url-status=dead | language=pl}}</ref> In each case, the attacker is able to compromise the particular cryptographic algorithm or protocol by inspecting the information that the backdoor information is encoded in (e.g., the public key, the digital signature, the key exchange messages, etc.) and then exploiting the logic of the asymmetric backdoor using their secret key (usually a private key).
-A. Juels and J. Guajardo<ref name="jg02">[https://web.archive.org/web/20120315234258/http://www.rsa.com/rsalabs/staff/bios/ajuels/publications/kegver/kegver.ps A. Juels, J. Guajardo, "RSA Key Generation with Verifiable Randomness"], in: D. Naccache, P. Pallier (Eds.), Public Key Cryptography: 4th International Workshop on Practice and Theory in Public Key Cryptosystems, Springer, 2002.</ref> proposed a method ([[KEGVER]]) through which a third party can verify RSA key generation. This is devised as a form of distributed key generation in which the secret key is only known to the [[black box]] itself. This assures that the key generation process was not modified and that the private key cannot be reproduced through a kleptographic attack.<ref name="jg02" /><ref>[https://web.archive.org/web/20130512223201/http://www.rsa.com/rsalabs/staff/bios/ajuels/publications/kegver/kv-extended.pdf A. Juels, J. Guajardo, "RSA Key Generation with Verifiable Randomness" (Extended version)]</ref>
+A. Juels and J. Guajardo<ref name="jg02">{{cite book | last=Juels | first=Ari | last2=Guajardo | first2=Jorge | title=Public Key Cryptography: 4th International Workshop on Practice and Theory in Public Key Cryptosystems | chapter=RSA Key Generation with Verifiable Randomness |editor-first1=D. |editor-last1=Naccache |editor-first2=P. |editor-last2=Pallier| publisher=Springer Berlin Heidelberg | year=2002 | isbn=978-3-540-43168-8 | issn=0302-9743 | doi=10.1007/3-540-45664-3_26 | page=357–374| chapter-url=http://www.rsa.com/rsalabs/staff/bios/ajuels/publications/kegver/kv-extended.pdf | archive-url=https://web.archive.org/web/20130512223201/http://www.rsa.com/rsalabs/staff/bios/ajuels/publications/kegver/kv-extended.pdf | archive-date=2013-05-12 | url-status=dead}}</ref> proposed a method ([[KEGVER]]) through which a third party can verify RSA key generation. This is devised as a form of distributed key generation in which the secret key is only known to the [[black box]] itself. This assures that the key generation process was not modified and that the private key cannot be reproduced through a kleptographic attack.<ref name="jg02" />
 ===Examples===
-Four practical examples of kleptographic attacks (including a simplified SETUP attack against RSA) can be found in JCrypTool 1.0,<ref>https://github.com/jcryptool JCrypTool project website</ref> the platform-independent version of the open-source [[CrypTool]] project.<ref name="be10">{{cite web |url=http://www.kes.info/archiv/online/10-4-006.htm |title=Die dunkle Seite der Kryptografie |accessdate=2011-01-19 |url-status=dead |archiveurl=https://web.archive.org/web/20110721215721/http://www.kes.info/archiv/online/10-4-006.htm |archivedate=2011-07-21 }} B. Esslinger, ''Die dunkle Seite der Kryptografie -- Kleptografie bei Black-Box-Implementierungen'', <kes>, #4 / 2010, page 6 ff. (German language only)</ref> A demonstration of the prevention of [[kleptographic attack]]s by means of the KEGVER method is also implemented in JCrypTool.
+Four practical examples of kleptographic attacks (including a simplified SETUP attack against RSA) can be found in JCrypTool 1.0,<ref>https://github.com/jcryptool JCrypTool project website</ref> the platform-independent version of the open-source [[CrypTool]] project.<ref name="be10">{{cite magazine | url=http://www.kes.info/archiv/online/10-4-006.htm | archive-url=https://web.archive.org/web/20110721215721/http://www.kes.info/archiv/online/10-4-006.htm | archive-date=2011-07-21 | url-status=dead | language=de |first=B. |last=Esslinger |title=Die dunkle Seite der Kryptografie - Kleptografie bei Black-Box-Implementierungen |magazine=&lt;kes&gt; |issue=4 |year=2010 |page=6}}</ref> A demonstration of the prevention of [[kleptographic attack]]s by means of the KEGVER method is also implemented in JCrypTool.
 The [[Dual_EC_DRBG]] [[cryptographic pseudo-random number generator]] from the [[NIST SP 800-90A]] is thought to contain a kleptographic backdoor. Dual_EC_DRBG utilizes [[elliptic curve cryptography]], and NSA is thought to hold a private key which, together with bias flaws in Dual_EC_DRBG, allows NSA to decrypt SSL traffic between computers using [[Dual_EC_DRBG]] for example.<ref>{{cite web|url=https://blog.cryptographyengineering.com/2013/09/18/the-many-flaws-of-dualecdrbg/|title=The Many Flaws of Dual_EC_DRBG|first=Matthew|last=Green|date=September 18, 2016|access-date=November 19, 2016}}</ref> The algebraic nature of the attack follows the structure of the repeated Dlog Kleptogram in the work of Young and [[Moti Yung| Yung]].