DEF CON 33 - No Spook Leaves Randomness to Chance - Shaanan Cohney
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 54:59
The talk explores how state-level adversaries like the NSA conduct mass surveillance by compromising cryptographic standards and certification processes 0:49-1:10. The researcher demonstrates how random number generator flaws in FIPS standards enabled widespread decryption vulnerabilities 12:02-12:09, and how these standards were compromised despite known weaknesses 15:14-15:29.
Key Takeaways:
• FIPS 140-2 standards contained backdoored random number generators like ANZX X9.31 with hardcoded keys that enabled decryption attacks 12:02-12:09, 18:18-18:26
• Dual EC DRBG, a NIST standard with known vulnerabilities since 2007, remained in standards until 2014 and was found in Juniper devices 25:18-25:32, 30:37-30:52
• Standards certification processes (CMVP) created systemic vulnerabilities by mandating flawed algorithms that adversaries could exploit 10:53-10:59
• The researcher calls this "pre-supply chain" attacks where adversaries influence design before implementation, affecting entire product categories 36:54-37:03
This research reveals how cryptographic standardization becomes a target for state-level surveillance, creating systemic vulnerabilities that persist for years despite public knowledge 33:52-34:06.
Sources:
- 0:49-1:10 Introduction to NSA mass decryption capabilities
- 12:02-12:09 FIPS ANZX X9.31 random number ge
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Okay, we're gonna get started. AB will come at some point. Until then, you get micro figures. I don't know if you can see anything there at all, but um we'll do what we can. So, I'm Shaan Connie. Um and I'm an academic researcher at the University of Melbourne. I'm going to start with my long list of thank yous. At that size font, you probably can't see it, but there is a long list of people who actually made all this research possible. Team of researchers across the world at various different universities. Um my particular journey I've done a fairly standard academic thing other than a few run-ins with the law during the during the process. Um some time in government I worked in the US Senate which also feeds into some of this talk and then at the US Federal Trade Commission. They're a li…