RSA Security
| Company type | Private |
|---|---|
| Industry | Computer security, network security, encryption |
| Predecessor | RSA Security, Inc. |
| Founded | 1982 |
| Founder | Ron Rivest, Adi Shamir, Leonard Adleman |
| Headquarters | Burlington, Massachusetts , United States |
Area served | Worldwide |
| Products | SecurID authentication device, BSAFE cryptographic libraries, RSA Conference |
| Owner | Symphony Technology Group, Ontario Teachers’ Pension Plan Board, AlpInvest Partners (consortium) |
| Parent | None |
RSA Security LLC, previously known as RSA Security, Inc. and commonly referred to as RSA, is a U.S.-based company specializing in computer and network security, with a focus on encryption and decryption technologies. The firm derives its name from its founders Ron Rivest, Adi Shamir, and Leonard Adleman, the creators of the RSA public key cryptosystem algorithm. RSA is well-known for products such as the SecurID authentication device and was the original proprietor of the BSAFE cryptographic libraries. The company has been scrutinized for embedding backdoors developed by the NSA within some of its offerings. Additionally, RSA organizes the annual RSA Conference, a leading gathering in the field of information security.
Established independently in 1982, RSA was purchased by EMC Corporation in 2006 for $2.1 billion, functioning as an EMC division until EMC’s acquisition by Dell Technologies in 2016, at which point RSA became part of Dell’s portfolio. On March 10, 2020, Dell divested RSA to a consortium led by Symphony Technology Group, Ontario Teachers’ Pension Plan Board, and AlpInvest Partners for $2.1 billion—the same amount EMC had paid fourteen years earlier.
With its headquarters located in Burlington, Massachusetts, RSA operates regional offices in Bracknell (UK) and Singapore, supporting a broad international presence across multiple countries.
History
Founded in 1982 by the inventors of the RSA encryption algorithm—Ron Rivest, Adi Shamir, and Leonard Adleman—RSA Data Security secured an exclusive global license from the Massachusetts Institute of Technology for the RSA cryptosystem patent in 1983.
Significant developments in RSA’s corporate evolution include:
- Resisting the implementation of the Clipper chip during the 1994 Crypto War.
- Spinning off Digital Certificates International (which later became VeriSign) in 1995.
- Being acquired by Security Dynamics in 1996, followed by acquiring DynaSoft AB in 1997.
- Initiating the first-ever DES Challenges in 1997 to publicly demonstrate advances in cryptanalysis.
- Expanding its portfolio through acquisitions: Xcert International (2001), 3-G International (2001) to enhance smart card and biometric authentication offerings, Securant Technologies (2001) to strengthen identity management, Cyota (2005) specializing in online security and fraud prevention, PassMark Security (2006), and Valyd Software (2007) focusing on data protection.
In 2006, EMC Corporation purchased RSA for $2.1 billion, integrating it as a central cybersecurity unit. During EMC ownership, RSA introduced initiatives such as the RSA Share Project in 2009, which provided select cryptographic libraries free of charge to encourage development.
After experiencing a major security breach in 2011 that compromised its SecurID tokens, RSA responded by launching the CyberCrime Intelligence Service to enhance threat intelligence capabilities. The company further broadened its Identity and Access Governance solutions by acquiring Aveksa in 2013.
Following Dell Technologies’ acquisition of EMC in 2016, RSA was incorporated into Dell EMC Infrastructure Solutions Group. In 2020, Dell announced it would sell RSA to Symphony Technology Group (STG) for $2.075 billion; prior to this transaction, Dell retained ownership of RSA’s BSAFE product line and related assets.
The acquisition by STG was finalized on September 1, 2020, restoring RSA’s status as an independent leader in cybersecurity and risk management with a worldwide presence and a diversified range of products and services.
SecurID security breach
On March 17, 2011, RSA revealed that its two-factor authentication products had been the target of a major cyberattack, identified as an advanced persistent threat. This incident compromised their SecurID system, which has since transitioned from relying on physical tokens to emphasizing software-based tokens.
Relationship with NSA
The dynamic between RSA and the NSA transformed over time from opposition to collaboration. Initially, RSA and key figures such as founder James Bidzos were strong proponents of public strong cryptography, actively resisting government initiatives like the Clipper Chip encryption backdoor endorsed by the Clinton administration. RSA led efforts to raise public awareness and demonstrated the weaknesses in government-backed encryption through cryptographic challenges.
After Bidzos stepped down as CEO in 1999, RSA’s position shifted. In 2004, the company reportedly received $10 million from the NSA to integrate the NSA-designed Dual EC DRBG random number generator into its BSAFE cryptographic library—a decision later scrutinized due to suspicions of a backdoor and concerns about the algorithm’s security. RSA justified this integration by citing industry-wide standards compliance and adherence to NIST guidelines until updated recommendations were issued in 2013.
In 2014, disclosures indicated that RSA had also incorporated NSA-supported extended random standards into some products. Subsequent cryptanalysis revealed that this standard did not enhance security and actually enabled quicker exploitation of the Dual EC DRBG backdoor by those with access to its secret key. Notably, RSA applied extended random only within the Java implementation of Dual EC DRBG.
This intricate relationship underscores RSA’s strategic balancing act between maintaining leadership in cybersecurity and managing governmental collaborations.
NSA Dual_EC_DRBG backdoor
Between 2004 and 2013, RSA distributed security products—such as the BSAFE toolkit and Data Protection Manager—that included a default cryptographically secure pseudorandom number generator, namely Dual EC DRBG. This generator was later suspected of harboring a covert National Security Agency kleptographic backdoor potentially enabling the NSA to decrypt data encrypted with these tools by using a secret private key. The backdoor exemplifies the Diffie Hellman kleptographic attack described in 1997 by Adam Young and Moti Yung.
It is believed that some RSA employees were aware of potential vulnerabilities in Dual_EC_DRBG. Three staff members participated in the ANSI X9F1 Tool Standards committee, which reviewed Dual_EC_DRBG during the early 2000s. John Kelsey, co-author of the NIST SP 800-90A standard that included Dual_EC_DRBG, recalled that concerns about a backdoor were first raised during an ANSI X9 meeting. In January 2005, two Certicom employees who were also part of X9F1 filed a patent describing a backdoor matching the NSA’s design and proposed three countermeasures. Two mitigations—independently selecting elliptic curve points P and Q and reducing output length—were included as optional standards; however, the NSA’s backdoored version remained set as default. Kelsey noted that implementers neither generated non-backdoored P and Q points nor used shorter output lengths.
Despite these warnings, NIST incorporated Dual_EC_DRBG into its 2006 NIST SP 800-90A standard with default parameters that enabled the suspected backdoor. This decision was heavily influenced by NSA representatives who pointed to RSA’s early adoption as validation. The standard did not address an unrelated predictability flaw identified in 2006 by Gjøsteen, who deemed Dual_EC_DRBG cryptographically weak.
In 2007, members of ANSI alongside Microsoft researchers Dan Shumow and Niels Ferguson publicly disclosed information about the backdoor. Security analyst Bruce Schneier described the potential NSA backdoor as "rather obvious" and questioned why NSA would promote Dual_EC_DRBG given its deficiencies. Awareness of RSA’s use of Dual_EC_DRBG as default since 2004 remained limited until revelations from Snowden’s leaks.
In September 2013, The New York Times, referencing documents leaked by Snowden, exposed NSA efforts to "embed vulnerabilities into commercial encryption systems," including Dual_EC_DRBG under the Bullrun program. It became widely recognized that RSA’s BSAFE product employed Dual_EC_DRBG by default.
Following this disclosure, RSA advised clients against using Dual_EC_DRBG but denied intentionally embedding any backdoor. Company representatives declined to clarify why they had not removed or mitigated the flawed generator once aware of its issues.
On December 20, 2013, Reuters reported that the NSA had secretly paid RSA $10 million in 2004 to designate Dual_EC_DRBG as BSAFE’s default cryptographically secure pseudorandom number generator (CSPRNG). Former employees indicated no internal alarms were raised because executives managed the agreement rather than technical staff. Schneier characterized this payment as a bribe. RSA refuted claims that any contract aimed to weaken their products. Reuters maintained their report's accuracy; media analyses described RSA’s response as a non-denial denial, denying only knowledge of the backdoor at contract time.
In reaction to these developments, numerous industry experts withdrew from speaking engagements at RSA's 2014 RSA Conference, including F-Secure researcher Mikko Hyppönen, who found RSA's denial suspicious and instead presented at TrustyCon—a concurrent counter-conference nearby.
During the 2014 conference, former Executive Chairman Art Coviello defended RSA’s ongoing use of Dual_EC_DRBG, explaining that concerns raised in 2007 only gained credibility after NIST acknowledged issues in 2013.
Products
RSA is widely recognized for its SecurID solution, which delivers two-factor authentication via hardware tokens featuring rotating keys, software tokens, and one-time passcodes. In 2016, this platform was rebranded as RSA SecurID Access, incorporating Single Sign-On capabilities and cloud-based authentication for resources utilizing SAML 2.0 alongside other federation standards.
The RSA SecurID Suite further encompasses RSA Identity Governance and Lifecycle (previously known as Aveksa), enabling organizations to gain comprehensive oversight and control over user access through functionalities such as access reviews, request management, and provisioning workflows.
RSA enVision functions as a security information and event management (SIEM) system that centralizes log data to facilitate compliance efforts and enhance incident response processes. After EMC's acquisition of NetWitness in 2011—a network packet capture technology—this tool was integrated into RSA’s portfolio as RSA Security Analytics, merging enVision’s log management with NetWitness’s packet capture capabilities to improve threat identification.
The RSA Archer GRC platform provides solutions for enterprise governance, risk management, and compliance (GRC). Initially created by Archer Technologies, it became part of RSA following EMC’s purchase of Archer in 2010.