[5506] in cryptography@c2.net mail archive
RE: NSA key in MSFT Crypto API
daemon@ATHENA.MIT.EDU (William H. Geiger III)
Fri Sep 3 14:14:01 1999
From: "William H. Geiger III" <whgiii@openpgp.net>
Date: Fri, 03 Sep 1999 11:19:05 -0500
To: "Trei, Peter" <ptrei@securitydynamics.com>
In-Reply-To: <D104150098E6D111B7830000F8D90AE8E62A42@exna02.securitydynamics.com>
Cc: "'Lucky Green'" <shamrock@cypherpunks.to>,
"cypherpunks@Algebra. COM" <cypherpunks@Algebra.COM>,
"'Salz,Rich'" <SalzR@CertCo.com>,
"Cryptography@C2. Net" <cryptography@c2.net>,
bugtraq@securityfocus.com
In <D104150098E6D111B7830000F8D90AE8E62A42@exna02.securitydynamics.com>,
on 09/03/99
at 11:49 AM, "Trei, Peter" <ptrei@securitydynamics.com> said:
>The ability to replace the NSA key with another
>is an extremely serious vulnerability. This means that
>*anyone* - not just the NSA - can write a compromised
>module and install it on the target, as long as they
>also replace the NSA key with the one they used to
>sign the weakened module.
>Tripwire, anyone?
It's very simple, DO NOT USE WINDOWS!!
This is a compromise in only one API. God only knows what they have done
to compromise security in the millions of lines of code that no one
outside of Redmond has ever seen.
Windows is compromised!! Microsoft is in bed with the Federal Government.
There is *no* security on a system running their software. Those who
continue to do so get exactly what they deserve.
--
---------------------------------------------------------------
William H. Geiger III http://www.openpgp.net
Geiger Consulting Cooking With Warp 4.0
Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
Hi Jeff!! :)
---------------------------------------------------------------
