Dan Shumow

Summary

(Learn how and when to remove this message)

Dan Shumow is a cryptographer working at Microsoft Research.

At the CRYPTO 2007 conference rump session, Dan Shumow and Niels Ferguson presented an informal paper describing a kleptographic backdoor in the NIST specified Dual_EC_DRBG cryptographically secure pseudorandom number generator.^[1] The backdoor was confirmed to be real in 2013 as part of the Edward Snowden leaks.

Dan Shumow co-authored an algorithm for detecting SHA-1 collisions with Marc Stevens, prior to the demonstration of a SHA-1 collision.^[2]

In 2024, Dan Shumow co-authored a paper^[3] described an attack against the RADIUS protocol, allowing a man-in-the-middle able between client and server to forge a valid protocol accept message in response to a failed authentication request.