Dan Shumow

Dan Shumow is a cryptographer working at Microsoft Research.

At the CRYPTO 2007 conference rump session, Dan Shumow and Niels Ferguson presented an informal paper describing a kleptographic backdoor in the NIST specified Dual_EC_DRBG cryptographically secure pseudorandom number generator. The backdoor was confirmed to be real in 2013 as part of the Edward Snowden leaks.

Dan Shumow co-authored an algorithm for detecting SHA-1 collisions with Marc Stevens, prior to the demonstration of a SHA-1 collision.

In 2024, Dan Shumow co-authored a paper described an attack against the RADIUS protocol, allowing a man-in-the-middle able between client and server to forge a valid protocol accept message in response to a failed authentication request.