Who uses RSA's BSAFE library? Does anyone know what products use it, or have any statistics on how many end users use something that is built on BSAFE?
Background: BSAFE is one of the oldest cryptography libraries, and among commercially available cryptographic libraries, it is well-respected. However, recent news suggests that BSAFE uses Dual_EC_DRBG as its default pseudorandom number generator. Dual_EC_DRBG, of course, is the algorithm that is suspected to contain a NSA backdoor. Previously, cryptographers had suggested that probably no one uses Dual_EC_DRBG, so the suspected backdoor probably doesn't have much practical impact; however, this news about the BSAFE library suggests we might want to re-examine that conclusion. In particular, it is possible that any backdoor in Dual_EC_DRBG backdoor might affect any products which use the RSA BSAFE library, so to assess the impact of this suspected backdoor, it would be helpful to better understand which products use BSAFE, and how many products and how many people rely upon BSAFE for their cryptography.
My question: Who uses RSA BSAFE? Which products are built on top of RSA BSAFE? How do I tell who might be affected by this issue? There's a big difference between an issue that affects a few internal enterprise tools, vs something that affects products used by millions of end users every day -- I'm trying to get a better sense for the degree of the impact of this issue, and to be in a better position to explain to others whether BSAFE's use of Dual_EC_DRBG is a big deal or not.
