The U.S. National Institute of Standards and Technology (NIST) has vigorously denied that the U.S. National Security Agency (NSA) tampered with NIST's process of vetting and choosing encryption algorithms.
"NIST would not deliberately weaken a cryptographic standard," NIST said in a statement Tuesday. "We will continue in our mission to work with the cryptographic community to create the strongest possible encryption standards for the U.S. government and industry at large."
The statement was issued five days after The New York Times accused the NSA of circumnavigating the NIST-approved encryption algorithms used to secure electronic communications, either by introducing virtually undetectable back doors in the algorithms or by subverting the public development process to weaken new encryption algorithms and supporting technologies.
NIST led development of many of the algorithms used to encrypt data on the Internet, such as AES (Advanced Encryption Standard) and the now largely defunct DES (Digital Encryption Standard). Both AES and DES are used in SSL (Secure Socket Layer), the protocol used by browsers to secure sensitive data.
In addition to issuing the statement, NIST has also reopened public comments for a number of proposed encryption related standards, namely Special Publication 800-90A and draft Special Publications 800-90B and 800-90C, which cover the random bit generators that provide random numbers to seed encryption keys.
NIST noted that it has worked closely with the NSA to help develop encryption standards, due to the NSA's expertise in this area. NIST is also required to consult with the NSA by U.S. legal statute. But the agency noted that its process for vetting encryption algorithms is an open one, in which anyone can review and comment on the work being done.
"If vulnerabilities are found in these or any other NIST standards, we will work with the cryptographic community to address them as quickly as possible," the statement read.
Joab Jackson covers enterprise software and general technology breaking news for The IDG News Service. Follow Joab on Twitter at @Joab_Jackson. Joab's e-mail address is Joab_Jackson@idg.com