[117619] in Cypherpunks
FW: Alert: CryptoAPI and _NSAKey issue
daemon@ATHENA.MIT.EDU (jbugden@ALIS.COM)
Tue Sep 7 10:25:32 1999
From: jbugden@ALIS.COM
Message-ID: <D19EFA51B95CD211B89200104B2CC23164BD16@ALIS-2>
To: cypherpunks@cyberpass.net
Date: Tue, 7 Sep 1999 10:05:52 -0400
MIME-Version: 1.0
Content-Type: text/plain
Reply-To: jbugden@ALIS.COM
> >This is also available at http://ntbugtraq.ntadvice.com/_nsakey.asp
> >
> >Whoa horsie...
> >
> >I had a long chat with Andrew Fernandes this morning, as well as
> >another chat with others, and of course I've had a ton of messages
> >sent my way with various links to various stories about the issue.
> >
> >I wanted to get a few things straight before I sent this message, but
> >given how quickly things are spreading it makes sent to send something
> >interim.
> >
> >Ok, so here's what I can tell you.
> >
> >1. Andrew's speculation about the _NSAKEY being a backdoor for the NSA
> >is based on;
> >
> >a) The variable is called "NSA".
> >
> >b) Its a second key, not known to exist in Windows previously.
> >
> >c) What possible purpose would a second key serve?
> >
> >d) Its presence, arguably, weakens CryptoAPI (Andrew explains this on
> >his website at <http://www.cryptonym.com/hottopics/msft-nsa.html>,
> >I'll elaborate more later.
> >
> >2. Sources close to Microsoft say that the key is a "Backup" key. It
> >is owned by Microsoft, and only Microsoft have the private key to it.
> >The key was named "_NSAKEY" because the NSA insisted that Microsoft
> >include a backup key in their CryptoAPI before the Commerce Department
> >would approve its inclusion in NT 4.0.
> >
>
> [editorial elided]
>
> >Russ - NTBugtraq Editor
>
