[117484] in Cypherpunks
RE: NSA key in MSFT Crypto API
daemon@ATHENA.MIT.EDU (Robert Hettinga)
Fri Sep 3 22:18:51 1999
Mime-Version: 1.0
Message-Id: <v04210118b3f62733add9@[204.167.100.144]>
Date: Fri, 3 Sep 1999 21:32:49 -0400
To: cypherpunks@cyberpass.net
From: Robert Hettinga <rah@shipwright.com>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Reply-To: Robert Hettinga <rah@shipwright.com>
--- begin forwarded text
From: "Tim Dierks" <tim@dierks.org>
To: "Cryptography@C2. Net" <cryptography@c2.net>, <bugtraq@securityfocus.com>
Subject: RE: NSA key in MSFT Crypto API
Date: Fri, 3 Sep 1999 17:15:08 -0700
Sender: owner-cryptography@c2.net
It's not clear to me why being able to sign CSP modules is a risky thing
anyway; all it means is that Windows will load and execute your crypto. The
mechanism is designed to keep overseas end users from being able to build
and install strong crypto libraries. If the NSA has a key, all they can do
is vouch for their libraries as export-qualified and thus enable their use.
It's not a secret backdoor or anything, and modules need to be on the
machine before their signatures are checked. If I can get you to execute
code on our Windows machine, I can penetrate your security, period. These
authorizing signatures have nothing to do with it.
Even if the key belongs to the NSA, I suspect that the NSA just wanted to be
able to load classified Crypto Service Providers into Windows and didn't
want to have to send said classified software to Microsoft for approval, so
they got the key installed so they could approve software in house.
- Tim
Tim Dierks
VP of Engineering, Certicom
tdierks@certicom.com
510.780.5409 [Hayward] -- 905.501.3791 [Mississauga]
--- end forwarded text
-----------------
Robert A. Hettinga <mailto: rah@ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
