Bullrun: NSA Crypto-Undermining and the Dual_EC_DRBG Backdoor (Revealed Sept 2013)

Introduction

In September 2013, ProPublica, the New York Times, and the Guardian jointly published an investigation drawing on Snowden documents that described a classified NSA programme codenamed Bullrun. Bullrun was described in NSA budget documents as a multi-decade effort to covertly undermine the encryption technologies used to secure internet communications — not by breaking mathematics, but by introducing weaknesses into standards, products, and implementations before they reached users.

Bullrun was the NSA counterpart to GCHQ's parallel programme, codenamed Edgehill. Together the programmes represented systematic covert action to subvert the cryptographic infrastructure on which secure internet communications depend.

What Bullrun Targeted

NSA budget documents described Bullrun as targeting the encryption used in HTTPS (the secure web), virtual private networks (VPNs), and the encryption built into fourth-generation mobile telecommunications standards. The documents described the NSA as having, by 2013, inserted ''vulnerabilities into commercial encryption systems, IT systems, networks, and endpoint communications devices used by targets.''

The methods described included: covertly influencing the development of international encryption standards through the standards bodies that set them; working with technology companies under legally compelled or voluntary arrangements to build exploitable weaknesses into their products; and developing or acquiring technical capabilities to exploit those weaknesses.

The Dual_EC_DRBG Backdoor

The most specific and technically documented component of the Bullrun revelations concerned a random number generator standard called Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG). The National Institute of Standards and Technology (NIST) had standardised Dual_EC_DRBG in Special Publication 800-90A in 2006.

Cryptographers had noted anomalies in Dual_EC_DRBG as early as 2006 and 2007. Researchers at Microsoft Research, including Dan Shumow and Niels Ferguson, demonstrated at the CRYPTO 2007 conference that the standard contained a potential backdoor: if the constants used in the elliptic curve algorithm were chosen in a specific way — knowing a secret discrete logarithm relationship between them — an observer who knew that relationship could predict the output of the generator from a small sample of its output, breaking the randomness on which cryptographic security depends.

The Snowden documents, as reported by the joint investigation, indicated that the NSA had worked to have Dual_EC_DRBG standardised by NIST and had pushed for its adoption, with knowledge of the backdoor. NIST subsequently reopened the standard for public comment and in 2014 withdrew Dual_EC_DRBG from its guidelines.

The RSA $10 Million Contract

In December 2013, Reuters reported that RSA Security — at the time one of the most prominent cryptography companies in the world, maker of the widely-used SecurID authentication token and the BSAFE encryption toolkit — had entered into a $10 million contract with the NSA in 2004. Under the contract, RSA made Dual_EC_DRBG the default random number generator in BSAFE. The result was that products built on BSAFE — widely used in commercial and government applications — were potentially vulnerable to anyone possessing the backdoor key.

RSA denied that it had knowingly incorporated a backdoor. The company stated it had not known at the time that Dual_EC_DRBG was potentially compromised. The plausibility of this denial was contested by cryptographers who noted that the 2007 public research raising backdoor concerns was available before many BSAFE deployments.

Broader Implications

Bullrun represented a fundamental tension in national security cryptography policy: the NSA simultaneously serves as the primary US signals intelligence agency (which benefits from weakened encryption it can exploit) and as an advisor to NIST on cryptographic standards for the protection of US government and commercial systems. The Dual_EC_DRBG episode demonstrated how these roles could conflict, and how the intelligence mission could actively undermine the security mission.

The Bullrun and Dual_EC_DRBG disclosures produced lasting changes in the cryptography standards community. NIST strengthened its processes for public review of standards, and the episode accelerated efforts across the industry to move away from algorithm families where NSA involvement in standardisation was significant.

Verdict

Confirmed. Bullrun is confirmed by NSA budget documents published in the joint ProPublica/NYT/Guardian investigation, subsequent government acknowledgements, the technical analysis of Dual_EC_DRBG by independent cryptographers, NIST's withdrawal of the standard in 2014, and the Reuters reporting on the RSA $10 million contract. The programme systematically undermined commercial encryption through standards manipulation and industry cooperation.

The Sigint Enabling Project: Bullrun's Budget Line

The September 2013 joint investigation did not rest solely on prose descriptions of Bullrun's goals — it drew directly on a classified US intelligence budget document, the 2013 'black budget,' which itemised a separate but closely related NSA programme called the Sigint Enabling Project. According to the Guardian's reporting on that budget, the Sigint Enabling Project cost $254.9 million in the 2013 fiscal year alone — more than ten times the budget of the better-known PRISM collection programme — and the document stated that the project "actively engages the US and foreign IT industries to covertly influence and/or overtly leverage their commercial products' designs" to make them exploitable. The same reporting noted that since 2011 total spending on Sigint-enabling work had passed $800 million, and that the fund had been used, among other things, to work with chip manufacturers to build weaknesses into the hardware encryption chips used to secure business and government systems.

This budget line matters because it moves Bullrun from a single anecdote (Dual_EC_DRBG at RSA) to a documented, sustained institutional programme with its own multi-year funding stream, spanning software, hardware, and standards work simultaneously. Bruce Schneier, one of a small number of journalists and cryptographers given direct access to the Snowden material by the Guardian, summarised the pattern in his own September 2013 essay: the NSA's approach, he wrote, was to ask companies to "subtly change their products in undetectable ways: making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol." Schneier pointed to earlier documented precedents — the Crypto AG affair and a suspected Lotus Notes weakening — as evidence this was a long-running institutional habit rather than a one-off Dual_EC episode, and observed that any backdoor caught in the act would typically be "explained away as a mistake," giving the agency built-in deniability.

From Standard to Real-World Exploit: The Juniper ScreenOS Incident

The clearest demonstration that a Dual_EC-style backdoor was not merely theoretical came two years after the Snowden revelations, from a company with no connection to RSA. In December 2015, Juniper Networks — a major maker of enterprise firewalls and VPN appliances — announced that an internal code review had turned up "unauthorized code" embedded in ScreenOS, the operating system running on its NetScreen firewall line. The US Department of Homeland Security's CISA issued an out-of-band alert on the disclosure, and Juniper's own SVP and CIO, Bob Worrall, stated on the company's support forum that the code "could allow a knowledgeable attacker to gain administrative access to NetScreen devices and to decrypt VPN connections."

Two distinct backdoors were involved. The first was a hardcoded authentication password hidden inside a debug string, which let anyone with a valid username bypass SSH or Telnet authentication entirely; security firm Fox-IT reportedly found the working password within about six hours of starting to look, and estimated it had been inserted into ScreenOS builds released in late 2013. Independent estimates at the time suggested roughly 26,000 NetScreen devices had SSH management exposed directly to the internet, meaning the flaw was not confined to a lab scenario.

The second backdoor was the one with a direct line back to Bullrun: it involved Dual_EC_DRBG, the same random-number-generator standard at the centre of the RSA/BSAFE story. Juniper had used Dual_EC in ScreenOS but — according to the company — had tried to protect itself by not using NSA's default elliptic-curve constant, generating its own "Q" parameter instead, and by additionally re-processing the generator's raw output through a second, faster algorithm (ANSI X9.17) before it was used, a design meant to blunt exactly the kind of prediction attack Dual_EC is vulnerable to.

How a Government Backdoor Became Somebody Else's Backdoor

That design turned out to fail on two separate fronts, and the way it failed is itself part of the Bullrun story. First, cryptographer Matthew Green's technical analysis, published within days of Juniper's disclosure, found a coding flaw in the ScreenOS implementation: a global variable governing output length was not being reset correctly, so instead of passing Dual_EC's output through the safer secondary algorithm, the code sometimes emitted 32 bytes of raw Dual_EC output directly — precisely the material an attacker who knows the discrete-log relationship between Dual_EC's constants needs to predict all future outputs and recover a VPN session's keys. Green wrote that with this flaw in place, an attacker "can predict future outputs of the RNG after seeing a mere 30 bytes of raw output."

Second, and more striking: forensic analysis (later formalised in the peer-reviewed paper "A Systematic Analysis of the Juniper Dual EC Incident" by Checkoway, Green, and other co-authors, presented at the 2016 ACM Conference on Computer and Communications Security) found that Juniper's own self-generated Q constant had itself been silently replaced in 2012 with a different value, one whose origin nobody outside the intruder has ever identified. Because Juniper had already built a system that trusted whatever Q value sat in that memory location — precisely the architecture the NSA had originally engineered into the Dual_EC standard — swapping in a new constant was enough on its own to hand a new, unknown party the same predictive power over ScreenOS's encryption that Dual_EC was designed to give its original author. As Green put it, the intruder "made no major code changes to the encryption mechanism — they only changed parameters," which is exactly what a backdoor built on a swappable secret constant allows anyone who can reach it to do.

Juniper has never publicly confirmed who altered the constant, and no government has claimed responsibility. The episode is widely cited in the security research community not as proof of who exploited Bullrun-style tooling, but as proof that a backdoor engineered for one actor's exclusive use does not stay exclusive: once the mechanism exists in shipping code, it is available to whoever can access and modify that code, whether that is the original designer, a rival intelligence service, or a criminal group.

The Academic Case: Why Dual_EC's Flaws Were Visible All Along

A further piece of the record, less widely reported than the Snowden leaks but directly relevant to the "was this really deliberate" question, is the 2015 paper "Dual EC: A Standardized Back Door" by cryptographers Daniel J. Bernstein, Tanja Lange, and Ruben Niederhagen. Their analysis, made public on the Cryptology ePrint Archive, walked through the standard's history and argued that Dual_EC carried design properties that made no sense on ordinary engineering grounds: the authors note the algorithm was "much slower than the alternatives and the numbers it provides are more biased, i.e., not random" compared to competing NIST-approved generators available at the same time. In ordinary cryptographic engineering, an algorithm that is both slower and statistically worse than its rivals is not normally adopted, let alone standardised by three separate bodies (NIST, ANSI, and ISO) and then defended for years after independent researchers flagged the backdoor risk in 2007. Bernstein, Lange, and Niederhagen's paper traces how the standardisation and patent process around Dual_EC allowed the anomaly to persist essentially unchallenged inside the standards ecosystem, reinforcing the 2013 reporting that this was long-run institutional strategy rather than an isolated engineering lapse.

Unresolved Questions and the Limits of the Evidence

None of this closes every gap. The precise scale of real-world NSA decryption enabled specifically through Dual_EC-based products remains classified and is not established by the public record — the Snowden documents describe capability and intent, and the RSA contract shows a commercial pathway existed, but the volume of live intelligence actually collected via Dual_EC-equipped products has never been disclosed or independently measured. Attribution for the 2012 tampering with Juniper's Q constant is likewise unresolved: it is consistent with a nation-state actor repurposing a known weakness, but ScreenOS's design meant that determining who made the change from the code alone was not possible, and Juniper's own investigation did not name a suspect. These gaps do not weaken the confirmed elements of Bullrun — the programme's existence, its budget, and the Dual_EC/RSA mechanism are documented — but they are a reminder that "confirmed programme" and "fully measured real-world impact" are different claims, and the public evidence base is strongest on the former.