Microsoft Drops Aging Encryption Schemes

christchurch wrote to mention an Eweek column about Microsoft's decision to stop using DES, MD4, and MD5 for encryption in Vista. From the article: "All three algorithms show signs of 'extreme weakness' and have been banned, Howard said. Microsoft is recommending using the Secure Hash Algorithm (SHA)256 encryption algorithm and AES (Advanced Encryption Standard) cipher instead, he said. The change is part of a semi-yearly update to Microsoft's Secure Development Lifecycle policies by engineers within Microsoft's Security Business & Technology Unit."

Comments

ROT13

[Anonymous Coward]

Presumably they haven't banned ROT13 then.

Re:ROT13

[wertarbyte]

Funny enough, IIRC Outlook Express is still not able to encrypt messages with ROT13. It just has the ability to decode them.

Teamwork

[Ruie]

The change is part of a semi-yearly update to Microsoft's Secure Development Lifecycle policies by engineers within Microsoft's Security Business & Technology Unit

As opposed to the quarterly update by managers ?

affects hardware upgrade cycles?

[qwertphobia]

Great... yet another reason to upgrade hardware when planning for a Vista install.

Gotta add more cycles to the those brute-force attack teams!

Automated checking

[LiquidCoooled]

Developers who use one of the banned cryptographic functions in new code will have it flagged by automated code scanning tools and will be asked to update the function to something more secure, Howard said.

C:\ > make windows.vista
ERROR: Insecure code found.
Please upgrade code to Linux.

The real reason...

[bigtallmofo]

DES, MD4, MD5 and, in some cases, the SHA1 encryption algorithm, which are "way too complicated to understand," said Michael Howard, senior security program manager at the company. "Instead, our R&D lab is doing great things with sophisticated XOR encryption that should be enough security for just about anyone."

improving encryption

[myukew]

this post is rot13 encrypted. twice. to improve security.

Alte4rnative encyrption schemes available..

[Rob T Firefly]

Microsoft has promised additional encryption schemes for power users, including ig-pay atin-lay, leaving out every third word, and Navajo code talkers.

Re:Alte4rnative encyrption schemes available..

[Rob T Firefly]

Not yet, I'm currently devoting all my clock cycles to elderly Italian relatives' hand signals.

In other words...

[Jugalator]

Microsoft Drops Aging Encryption Schemes

In other words, Microsoft Drops AES?
Man, I'm so confused now. :-p

...

OK, you can stop throwing /tomatoe?s/ now.

Translate to Devspeak

[boatboy]

The article is in plain English. I haven't seen it on MSDN yet, but I imagine this is the gist in developer-speak:

Microsoft will be marking the DES, MD4, MD5 and SHA1 encryption provider classes obselete in upcoming versions of the .NET framework. While not completely insecure, these algorithms have documented vulnerabilities which mean they can be cracked or exploited in certain scenarios. FxCop will warn you when it finds these classes in use, and provide a suggested fix. Typically, this will simply envolve switching the provider you are using with the more secure SHA256 or AES providers.

Re:HTTP Digest

[multipartmixed]

(Putting on pointy-hair wig)

MD5 is deprecated, but every web server still supports basic authentication, which uses Base64. Hmm.

64 is much bigger than 5, so it must be better.

Yup. No more digest authentication, only basic will be supported! Another security problem averted; quick: call the press!