Bullrun: NSA Crypto-Undermining and the Dual_EC_DRBG Backdoor (Revealed Sept 2013)
Introduction
In September 2013, ProPublica, the New York Times, and the Guardian jointly published an investigation drawing on Snowden documents that described a classified NSA programme codenamed Bullrun. Bullrun was described in NSA budget documents as a multi-decade effort to covertly undermine the encryption technologies used to secure internet communications — not by breaking mathematics, but by introducing weaknesses into standards, products, and implementations before they reached users.
Bullrun was the NSA counterpart to GCHQ's parallel programme, codenamed Edgehill. Together the programmes represented systematic covert action to subvert the cryptographic infrastructure on which secure internet communications depend.
What Bullrun Targeted
NSA budget documents described Bullrun as targeting the encryption used in HTTPS (the secure web), virtual private networks (VPNs), and the encryption built into fourth-generation mobile telecommunications standards. The documents described the NSA as having, by 2013, inserted ''vulnerabilities into commercial encryption systems, IT systems, networks, and endpoint communications devices used by targets.''
The methods described included: covertly influencing the development of international encryption standards through the standards bodies that set them; working with technology companies under legally compelled or voluntary arrangements to build exploitable weaknesses into their products; and developing or acquiring technical capabilities to exploit those weaknesses.
The Dual_EC_DRBG Backdoor
The most specific and technically documented component of the Bullrun revelations concerned a random number generator standard called Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG). The National Institute of Standards and Technology (NIST) had standardised Dual_EC_DRBG in Special Publication 800-90A in 2006.
Cryptographers had noted anomalies in Dual_EC_DRBG as early as 2006 and 2007. Researchers at Microsoft Research, including Dan Shumow and Niels Ferguson, demonstrated at the CRYPTO 2007 conference that the standard contained a potential backdoor: if the constants used in the elliptic curve algorithm were chosen in a specific way — knowing a secret discrete logarithm relationship between them — an observer who knew that relationship could predict the output of the generator from a small sample of its output, breaking the randomness on which cryptographic security depends.
The Snowden documents, as reported by the joint investigation, indicated that the NSA had worked to have Dual_EC_DRBG standardised by NIST and had pushed for its adoption, with knowledge of the backdoor. NIST subsequently reopened the standard for public comment and in 2014 withdrew Dual_EC_DRBG from its guidelines.
The RSA $10 Million Contract
In December 2013, Reuters reported that RSA Security — at the time one of the most prominent cryptography companies in the world, maker of the widely-used SecurID authentication token and the BSAFE encryption toolkit — had entered into a $10 million contract with the NSA in 2004. Under the contract, RSA made Dual_EC_DRBG the default random number generator in BSAFE. The result was that products built on BSAFE — widely used in commercial and government applications — were potentially vulnerable to anyone possessing the backdoor key.
RSA denied that it had knowingly incorporated a backdoor. The company stated it had not known at the time that Dual_EC_DRBG was potentially compromised. The plausibility of this denial was contested by cryptographers who noted that the 2007 public research raising backdoor concerns was available before many BSAFE deployments.
Broader Implications
Bullrun represented a fundamental tension in national security cryptography policy: the NSA simultaneously serves as the primary US signals intelligence agency (which benefits from weakened encryption it can exploit) and as an advisor to NIST on cryptographic standards for the protection of US government and commercial systems. The Dual_EC_DRBG episode demonstrated how these roles could conflict, and how the intelligence mission could actively undermine the security mission.
The Bullrun and Dual_EC_DRBG disclosures produced lasting changes in the cryptography standards community. NIST strengthened its processes for public review of standards, and the episode accelerated efforts across the industry to move away from algorithm families where NSA involvement in standardisation was significant.
Verdict
Confirmed. Bullrun is confirmed by NSA budget documents published in the joint ProPublica/NYT/Guardian investigation, subsequent government acknowledgements, the technical analysis of Dual_EC_DRBG by independent cryptographers, NIST's withdrawal of the standard in 2014, and the Reuters reporting on the RSA $10 million contract. The programme systematically undermined commercial encryption through standards manipulation and industry cooperation.
Evidence Filters17
NSA budget documents confirm Bullrun programme and its objectives
SupportingStrongNSA budget documents published in the ProPublica/NYT/Guardian joint investigation describe Bullrun as a programme to covertly insert vulnerabilities into commercial encryption systems and influence international standards. The documents are primary-source confirmation.
Dual_EC_DRBG backdoor identified independently by cryptographers in 2007
SupportingStrongDan Shumow and Niels Ferguson presented research at CRYPTO 2007 demonstrating that Dual_EC_DRBG contained a potential backdoor if the elliptic curve constants were chosen with knowledge of a secret discrete logarithm. This independent cryptographic finding predates the Snowden revelations and corroborates the NSA's role.
NIST withdrew Dual_EC_DRBG from guidelines in 2014
SupportingStrongFollowing the Bullrun revelations and cryptographic analysis, NIST withdrew Dual_EC_DRBG from Special Publication 800-90A in 2014. The withdrawal of an official US government standard is a significant institutional acknowledgement of the backdoor concern.
Reuters: RSA received $10 million from NSA to default Dual_EC in BSAFE
SupportingStrongA December 2013 Reuters investigation reported that RSA Security had received a $10 million NSA contract in 2004 to make Dual_EC_DRBG the default random number generator in its BSAFE encryption toolkit, spreading the potentially backdoored generator across commercial and government applications.
RSA denied knowing Dual_EC was compromised
DebunkingRSA Security denied that it had knowingly included a backdoored generator in BSAFE, stating it had not been aware of the potential compromise at the time of the contract. The denial raises questions about due diligence given the 2007 public cryptographic research.
Rebuttal
RSA's denial concerns its own knowledge and intent, not the existence of the backdoor or the NSA contract. Independent analysis of the Dual_EC_DRBG constants confirms the mathematical basis for the backdoor regardless of what RSA knew.
Programme represented systematic conflict between NSA's intelligence and security missions
SupportingStrongBullrun highlighted a fundamental institutional tension: the NSA simultaneously advises NIST on cryptographic standards for US government and commercial security while also exploiting weaknesses in those standards for intelligence collection. The conflict of interest is structural and confirmed.
GCHQ Edgehill programme was British parallel to Bullrun
SupportingDocuments in the Snowden archive confirmed that GCHQ operated a parallel programme codenamed Edgehill with similar objectives to Bullrun, confirming the systematic Five Eyes approach to undermining commercial encryption rather than an isolated NSA activity.
Bullrun disclosures accelerated industry movement to verified cryptographic standards
SupportingFollowing the Bullrun revelations, the cryptography and internet standards communities accelerated review of NIST standards with NSA involvement, moved toward algorithm families less susceptible to NSA influence, and strengthened processes for public scrutiny of proposed standards.
Dual EC DRBG Backdoor Mathematically Confirmed
SupportingStrongCryptographers at Microsoft Research (Bernstein, Lange, et al.) published a 2013 paper demonstrating that the Dual Elliptic Curve Deterministic Random Bit Generator contained a verifiable mathematical backdoor: knowledge of the discrete logarithm relationship between two constants would allow complete prediction of outputs. NIST withdrew the algorithm from its Special Publication 800-90A in April 2014 after NSA involvement in setting the constants was established by the Snowden documents.
RSA Security Received $10 Million NSA Contract to Use Dual EC
SupportingStrongReuters reported in December 2013, citing Snowden documents, that RSA Security had accepted a $10 million NSA contract to set Dual EC DRBG as the default random number generator in its BSAFE toolkit. RSA disputed characterization of the arrangement as a secret deal, stating it had relied on NIST's 2006 standardization and the NSA's role as a trusted standards body.
Show 7 more evidence points
Scope of BULLRUN Remains Classified; Full Impact Unverified
NeutralThe published Snowden documents described BULLRUN in general terms as a program to defeat commercial encryption through multiple methods including insertion of vulnerabilities, exploitation of implementation flaws, and court orders. The full extent of the program — how many standards were compromised, which commercial products were affected — remains classified. Independent security researchers have not been able to confirm NSA access to all systems the program reportedly targeted.
Cryptographers Flagged Dual_EC_DRBG Weaknesses in 2007, Before Snowden
DebunkingDan Shumow and Niels Ferguson publicly demonstrated the potential backdoor structure of Dual_EC_DRBG at CRYPTO 2007, six years before the Snowden disclosures. Bruce Schneier and Daniel Bernstein independently noted the anomaly. This means the cryptographic community's self-correcting mechanisms partially worked: the flaw was identified, debated, and Dual_EC was rarely deployed in practice outside RSA Security's BSAFE library. The BULLRUN revelations confirmed what the research community already suspected about that specific algorithm. This limits the claim that NSA systematically subverted crypto standards undetected — at least in this case, the subversion was noticed and flagged by independent researchers operating through normal channels.
Post-Snowden Standards Processes Explicitly Excluded NSA Influence
DebunkingFollowing the 2013 Snowden disclosures, NIST withdrew Dual_EC_DRBG from its recommendations and restructured its cryptographic standards process to increase transparency and external review. The NIST Post-Quantum Cryptography competition (launched 2016) was explicitly designed with open international participation, public comment periods, and cryptanalysis rounds to prevent the kind of opaque insertion alleged with Dual_EC. Widely deployed modern standards — AES-GCM, ChaCha20-Poly1305, X25519 — have been extensively reviewed and show no credible evidence of NSA backdooring. The BULLRUN story, accurately read, is about one specific algorithm and some commercial product influence, not wholesale subversion of all encryption standards.
Cryptographers Publicly Flagged Dual_EC Weakness in 2007, Six Years Before Snowden
DebunkingDan Shumow and Niels Ferguson presented a public analysis at CRYPTO 2007 demonstrating that Dual Elliptic Curve Deterministic Random Bit Generator had a potential backdoor structure if its constants were chosen with knowledge of a discrete logarithm relationship. This was not a secret finding — it was published in conference proceedings and widely discussed in the cryptographic community. The NSA's alleged deliberate insertion of the weakness was exposed through open academic cryptanalysis, not whistleblowing. This demonstrates that the cryptographic peer-review system eventually identified the problem through normal scientific channels.
Post-Snowden NIST Standards Processes Explicitly Excluded NSA Influence
DebunkingFollowing the 2013 Snowden revelations, NIST conducted an internal review, withdrew Dual_EC_DRBG from its standards, and restructured its cryptographic standards process to include external cryptographic experts and increase transparency of deliberations. NIST's post-2015 post-quantum cryptography standardization process explicitly used open international competition with public analysis periods. These institutional reforms directly addressed the vulnerability that BULLRUN revealed. Not all encryption standards are compromised; the post-2013 standards landscape reflects a measurable response to demonstrated NSA overreach.
Cryptographers Flagged Dual_EC Weakness Before Snowden
NeutralStrongDan Shumow and Niels Ferguson publicly presented mathematical analysis at CRYPTO 2007 demonstrating that Dual_EC_DRBG's parameters could contain a backdoor if generated by a party who knew the discrete-log relationship. This was six years before Snowden's disclosures. The cryptographic community's self-correcting peer review — not whistleblowing — identified the specific weakness, suggesting the NSA's influence on NIST was exploitable but not impenetrable to scrutiny. NIST withdrew Dual_EC in 2014 following the Snowden context but acting on pre-existing mathematical objections.
Post-2013 NIST Standards Were Developed With Explicit NSA Exclusion
DebunkingStrongFollowing the Dual_EC controversy, NIST undertook a transparent public process for post-quantum cryptography standardisation (PQC, 2016–2024) that explicitly invited international cryptographic community participation and published all candidate algorithm evaluations. The resulting standards (CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+) were selected through open competition with no credible evidence of NSA backdooring. Not all encryption standards were compromised by BULLRUN; the programme appears to have targeted specific legacy implementations and certificate-authority relationships rather than mathematics universally.
Evidence Cited by Believers9
NSA budget documents confirm Bullrun programme and its objectives
SupportingStrongNSA budget documents published in the ProPublica/NYT/Guardian joint investigation describe Bullrun as a programme to covertly insert vulnerabilities into commercial encryption systems and influence international standards. The documents are primary-source confirmation.
Dual_EC_DRBG backdoor identified independently by cryptographers in 2007
SupportingStrongDan Shumow and Niels Ferguson presented research at CRYPTO 2007 demonstrating that Dual_EC_DRBG contained a potential backdoor if the elliptic curve constants were chosen with knowledge of a secret discrete logarithm. This independent cryptographic finding predates the Snowden revelations and corroborates the NSA's role.
NIST withdrew Dual_EC_DRBG from guidelines in 2014
SupportingStrongFollowing the Bullrun revelations and cryptographic analysis, NIST withdrew Dual_EC_DRBG from Special Publication 800-90A in 2014. The withdrawal of an official US government standard is a significant institutional acknowledgement of the backdoor concern.
Reuters: RSA received $10 million from NSA to default Dual_EC in BSAFE
SupportingStrongA December 2013 Reuters investigation reported that RSA Security had received a $10 million NSA contract in 2004 to make Dual_EC_DRBG the default random number generator in its BSAFE encryption toolkit, spreading the potentially backdoored generator across commercial and government applications.
Programme represented systematic conflict between NSA's intelligence and security missions
SupportingStrongBullrun highlighted a fundamental institutional tension: the NSA simultaneously advises NIST on cryptographic standards for US government and commercial security while also exploiting weaknesses in those standards for intelligence collection. The conflict of interest is structural and confirmed.
GCHQ Edgehill programme was British parallel to Bullrun
SupportingDocuments in the Snowden archive confirmed that GCHQ operated a parallel programme codenamed Edgehill with similar objectives to Bullrun, confirming the systematic Five Eyes approach to undermining commercial encryption rather than an isolated NSA activity.
Bullrun disclosures accelerated industry movement to verified cryptographic standards
SupportingFollowing the Bullrun revelations, the cryptography and internet standards communities accelerated review of NIST standards with NSA involvement, moved toward algorithm families less susceptible to NSA influence, and strengthened processes for public scrutiny of proposed standards.
Dual EC DRBG Backdoor Mathematically Confirmed
SupportingStrongCryptographers at Microsoft Research (Bernstein, Lange, et al.) published a 2013 paper demonstrating that the Dual Elliptic Curve Deterministic Random Bit Generator contained a verifiable mathematical backdoor: knowledge of the discrete logarithm relationship between two constants would allow complete prediction of outputs. NIST withdrew the algorithm from its Special Publication 800-90A in April 2014 after NSA involvement in setting the constants was established by the Snowden documents.
RSA Security Received $10 Million NSA Contract to Use Dual EC
SupportingStrongReuters reported in December 2013, citing Snowden documents, that RSA Security had accepted a $10 million NSA contract to set Dual EC DRBG as the default random number generator in its BSAFE toolkit. RSA disputed characterization of the arrangement as a secret deal, stating it had relied on NIST's 2006 standardization and the NSA's role as a trusted standards body.
Counter-Evidence6
RSA denied knowing Dual_EC was compromised
DebunkingRSA Security denied that it had knowingly included a backdoored generator in BSAFE, stating it had not been aware of the potential compromise at the time of the contract. The denial raises questions about due diligence given the 2007 public cryptographic research.
Rebuttal
RSA's denial concerns its own knowledge and intent, not the existence of the backdoor or the NSA contract. Independent analysis of the Dual_EC_DRBG constants confirms the mathematical basis for the backdoor regardless of what RSA knew.
Cryptographers Flagged Dual_EC_DRBG Weaknesses in 2007, Before Snowden
DebunkingDan Shumow and Niels Ferguson publicly demonstrated the potential backdoor structure of Dual_EC_DRBG at CRYPTO 2007, six years before the Snowden disclosures. Bruce Schneier and Daniel Bernstein independently noted the anomaly. This means the cryptographic community's self-correcting mechanisms partially worked: the flaw was identified, debated, and Dual_EC was rarely deployed in practice outside RSA Security's BSAFE library. The BULLRUN revelations confirmed what the research community already suspected about that specific algorithm. This limits the claim that NSA systematically subverted crypto standards undetected — at least in this case, the subversion was noticed and flagged by independent researchers operating through normal channels.
Post-Snowden Standards Processes Explicitly Excluded NSA Influence
DebunkingFollowing the 2013 Snowden disclosures, NIST withdrew Dual_EC_DRBG from its recommendations and restructured its cryptographic standards process to increase transparency and external review. The NIST Post-Quantum Cryptography competition (launched 2016) was explicitly designed with open international participation, public comment periods, and cryptanalysis rounds to prevent the kind of opaque insertion alleged with Dual_EC. Widely deployed modern standards — AES-GCM, ChaCha20-Poly1305, X25519 — have been extensively reviewed and show no credible evidence of NSA backdooring. The BULLRUN story, accurately read, is about one specific algorithm and some commercial product influence, not wholesale subversion of all encryption standards.
Cryptographers Publicly Flagged Dual_EC Weakness in 2007, Six Years Before Snowden
DebunkingDan Shumow and Niels Ferguson presented a public analysis at CRYPTO 2007 demonstrating that Dual Elliptic Curve Deterministic Random Bit Generator had a potential backdoor structure if its constants were chosen with knowledge of a discrete logarithm relationship. This was not a secret finding — it was published in conference proceedings and widely discussed in the cryptographic community. The NSA's alleged deliberate insertion of the weakness was exposed through open academic cryptanalysis, not whistleblowing. This demonstrates that the cryptographic peer-review system eventually identified the problem through normal scientific channels.
Post-Snowden NIST Standards Processes Explicitly Excluded NSA Influence
DebunkingFollowing the 2013 Snowden revelations, NIST conducted an internal review, withdrew Dual_EC_DRBG from its standards, and restructured its cryptographic standards process to include external cryptographic experts and increase transparency of deliberations. NIST's post-2015 post-quantum cryptography standardization process explicitly used open international competition with public analysis periods. These institutional reforms directly addressed the vulnerability that BULLRUN revealed. Not all encryption standards are compromised; the post-2013 standards landscape reflects a measurable response to demonstrated NSA overreach.
Post-2013 NIST Standards Were Developed With Explicit NSA Exclusion
DebunkingStrongFollowing the Dual_EC controversy, NIST undertook a transparent public process for post-quantum cryptography standardisation (PQC, 2016–2024) that explicitly invited international cryptographic community participation and published all candidate algorithm evaluations. The resulting standards (CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+) were selected through open competition with no credible evidence of NSA backdooring. Not all encryption standards were compromised by BULLRUN; the programme appears to have targeted specific legacy implementations and certificate-authority relationships rather than mathematics universally.
Neutral / Ambiguous2
Scope of BULLRUN Remains Classified; Full Impact Unverified
NeutralThe published Snowden documents described BULLRUN in general terms as a program to defeat commercial encryption through multiple methods including insertion of vulnerabilities, exploitation of implementation flaws, and court orders. The full extent of the program — how many standards were compromised, which commercial products were affected — remains classified. Independent security researchers have not been able to confirm NSA access to all systems the program reportedly targeted.
Cryptographers Flagged Dual_EC Weakness Before Snowden
NeutralStrongDan Shumow and Niels Ferguson publicly presented mathematical analysis at CRYPTO 2007 demonstrating that Dual_EC_DRBG's parameters could contain a backdoor if generated by a party who knew the discrete-log relationship. This was six years before Snowden's disclosures. The cryptographic community's self-correcting peer review — not whistleblowing — identified the specific weakness, suggesting the NSA's influence on NIST was exploitable but not impenetrable to scrutiny. NIST withdrew Dual_EC in 2014 following the Snowden context but acting on pre-existing mathematical objections.
Timeline
NIST publishes SP 800-90 including Dual EC DRBG
The National Institute of Standards and Technology standardizes the Dual Elliptic Curve DRBG algorithm despite objections from cryptographers Dan Shumow and Niels Ferguson who noted the suspicious structure of the curve constants at the CRYPTO 2007 conference.
NIST standardises Dual_EC_DRBG in SP 800-90A
NIST publishes Special Publication 800-90A standardising Dual_EC_DRBG. The standard had been developed with significant NSA input. Cryptographers begin noting anomalies in the elliptic curve constants.
Shumow and Ferguson present Dual_EC backdoor research at CRYPTO 2007
Microsoft cryptographers Dan Shumow and Niels Ferguson present research at the CRYPTO 2007 rump session demonstrating that Dual_EC_DRBG contains a potential backdoor exploitable by anyone knowing a secret discrete logarithm relationship between the algorithm's constants.
Source →ProPublica/NYT/Guardian publish Bullrun joint investigation
The joint investigation publishes NSA budget documents describing Bullrun, including its objectives of inserting vulnerabilities into commercial encryption and influencing standards. The Reuters report on the RSA $10 million contract follows in December 2013.
Source →
Verdict
Confirmed by NSA budget documents in the joint ProPublica/NYT/Guardian September 2013 investigation. Bullrun systematically undermined commercial encryption through standards manipulation (Dual_EC_DRBG/NIST) and industry arrangements. The Dual_EC_DRBG backdoor was identified independently by cryptographers in 2007. NIST withdrew the standard in 2014. Reuters confirmed RSA received $10M from NSA to make Dual_EC the default in BSAFE in December 2013.
Frequently Asked Questions
What is Dual_EC_DRBG and why does it matter?
Dual_EC_DRBG (Dual Elliptic Curve Deterministic Random Bit Generator) is a cryptographic random number generator standardised by NIST in 2006. Cryptographic security depends on unpredictable random numbers; a predictable or backdoored random number generator undermines all cryptography built on it. Microsoft cryptographers demonstrated in 2007 that Dual_EC contained a potential backdoor exploitable by anyone knowing a secret discrete logarithm in the algorithm's constants. Snowden documents indicated the NSA had arranged this.
Did RSA Security knowingly incorporate a backdoored generator?
RSA Security denied that it had knowingly incorporated a backdoor, stating it had not known Dual_EC_DRBG was potentially compromised at the time of its $10 million contract with the NSA. Critics noted that the 2007 cryptographic research identifying the potential backdoor was publicly available well before many BSAFE deployments, raising questions about RSA's due diligence.
What did NIST do after the Bullrun revelations?
NIST reopened Dual_EC_DRBG for public comment following the September 2013 revelations. In April 2014, NIST formally withdrew Dual_EC_DRBG from Special Publication 800-90A. NIST also undertook a broader review of its cryptographic standards development process to strengthen transparency and reduce the potential for external influence on algorithm selection.
What is the conflict of interest at the heart of Bullrun?
Sources
Show 6 more sources
Further Reading
- paperShumow and Ferguson: On the Possibility of a Back Door in the NIST SP800-90 Dual EC PRNG — Dan Shumow, Niels Ferguson (2007)
- articleN.S.A. able to foil basic safeguards of privacy on web (NYT/ProPublica) — Nicole Perlroth, Scott Shane, Jeff Larson (2013)
- articleExclusive: NSA infiltrated RSA security more deeply than thought (Reuters) — Joseph Menn (2013)
- bookData and Goliath: The Hidden Battles to Collect Your Data and Control Your World — Bruce Schneier (2015)