Slashdot Mirror
Microsoft NSA key Follow-Up
Signal 11 writes "Bruce
Schneier at Counterpane has some interesting comments about the so-called NSA key embedded into all current versions of windows.
" If you missed the fireworks, read the first story or Microsoft response.
yes, it seems that the NAME of a key is a bit weak evidence to use.
However, I think people began to have more fun with the "government has evil plans" conspiracy theories and they lost track of the real topic. So far, there seems to be no *real* evidence of anything, either way, at all.
the real lesson should _not_ be "be afraid of MS and the NSA", it should be "THINK about what you are reading and get more information".
If you don't, you will be one of the unsuspecting masses who will get blinded by propaganda.
---
I hope you're not pretending to be evil while secretly being good. That would be dishonest.
Microsoft put in one key, then when the NSA reviewed the code they said MS should have two keys. Why? dunno, but I think the NSA knows more about information security than you, I, or Microsoft.
I'm sure you're right that the NSA wants that. However, the way they would _GET_ that is either asking Microsoft to give them MS' secret key so they can write their own codes, OR secretly replacing Microsoft's public key with their own on the computers they're using (after all, there is no reason to continue using MS' key).
So this isn't a good explanation for the existance of the second key.
I think the true explanation is even simpler: someone who didn't know crypto added it and specified its features, and either nobody who knew crypto paid attention, or their warnings simply weren't heeded until too late.
I've seen this happen MANY times, and it's astounding how smart, well-worded, and properly delivered arguments can be completely ignored until it's too late.
I'm sure the third key got in W2K in a very similar way.
-Billy
A buffer overflow.
A buffer overflow that they know about, is not publicized and is not getting fixed.
In fact this is absolutely indistinguishable from an honest mistake of a sort that is so common that nobody would think twice. But still it allows any access that they want.
Now all of that said, there is more. Remember a long time ago that Bruce Perens came out with warning that a proprietary company could submit a patch with a backdoor which they could then exploit later against OSS? Remember how he got flamed over it? People were saying, "What are they going to do? If they put in an if condition, anyone can see it and remove it. They would never do that!"
Um, not quite. They could do it by putting a buffer overflow in a known place. It looks just like an honest mistake, there are lots more just like it scattered through plenty of OSS projects. If caught it is a minor oops, not even a hint of suspicion.
The moral is that as long as buffer overflows are accepted and common, backdoors for those we don't want to have them will be easy to come by.
Cheers,
Ben
My usual seat in the cluetrain is at A HREF="http://pub4.ezboard.com/biwethey.ht
Two words: Lock Picks.
well, not really, but you get the idea, if "they" can get to the computer under that kind of security, then "they" must also want it enough to break through the crypto. Very possible, but incredibly difficult with current crypto schemes and large keysizes.
It really is just another hoop for any intruders to jump through (and oftentimes much more time consuming than any of the others if they can't find your key or predict it from the random number generator algorithm). That's all. If those measures are being taken already, not too difficult to add one more...
Jeff
You might as well just put a couple of filing cabinets in that metal room (well, almost).
--
Fuck the system? Nah, you might catch something.
The NSA knows 16 bits of the Netscape export key too - and the same probably goes for a number of other export software packages. No reason to finger Lotus Notes specifically.
Business. Numbers. Money. People. Computer World.
This particular thing isn't a weak link -- it's an accidentally strong link which allows anybody with any decent hacking skills to upgrade their system to use strong crypto.
It's pie ALL over MS' face, and Linux has the same strength -- only Linux has it intentionally, not accidentally.
As to the part about viruses being able to replace your crypt with weak crypto -- okay, it's a danger, but only if you haven't replaced the key yourself already.
This is a GREAT opportunity for everyone to upgrade their security.
-Billy
OK, I can see the use of the second key to make changes to the first key. However, for purposes of backup against natural disaster, why not just break up the key and keep copies of the pieces? In order to compromise the security of the key, it would be necessary to breach the security of each portion of the key (ie, break into the underground vault.) In order for the key to fall prey to disaster, there would have to be a disaster at each site.
The NATO and the German army are using unmodified Windows NT, running Microsoft Office, in the Kosovo and Bosnia. The German army is using Lotus Notes, the export version, to communicate internally. The Swedish govment is using Lotus Notes, the export version, to communicate internally.
Be afraid. Very afraid.
Perhaps only the second is trivially replaceable, (ie, simply hexedit the string to a bunch of zeros)...
> 4. The key "locations" were never "known" prior to sp5.
This is not known. I'm sure people poked through MS's DLLs before. And the key did have the characteristic form of a key, as in, that string of bytes did look like a key. What we didn't know until recently was the symbol names that went with the data. (But the actual location and value of the data is *trivial* to rip out of an executable.)
> 5. In exported versions its 40 bit. Not a terribly difficult crack.
The strongest encryption you are allowed to install is 40b. But there are fewer restrictions on the use of encryption in such a way that arbitrary data can't be sent. One example of this is digital signing, such as it's used in the CryptoAPI. Especially when the intended use of the digital signing is to keep people from installing strong crypto in violation of those very export laws. 6. Yes you can replace it with a program, but with the first key to authenticate me as i spoof widgets.com, I can replace it without your knowledge or approval.
No, there's nothing in here that lets you install anything on someone's computer without their approval. They still need to initiate the install (by running the installer, or a trojan of some sort). What the key does is allow the CryptoAPI to check if the crypto package you install is signed by MS, or the NSA, the only two entities (in this case) who are supposed to sign valid crypto components for Windows.
You *could*, with a trojan, replace that key, or simply crack the cryptoAPI to not check, and then allow the installation of unsigned crypto modules. But, this would be silly and redundant to use in an attack.
If you could gain access to someone's computer (via trojan, physical access, etc) then you could simply install a keyboard monitor, or some such, and read all of their data directly, bypassing any crypto. You wouldn't need to hack the crypto module, install broken/weak crypto, then crack it later. And if you did this, the people they tried to communicate wouldn't understand it, because the crypto algorithms wouldn't match.
No, the only '3v1l h4x0r' trick to do here is simply crack *YOUR* CryptoAPI (and let your friends do the same) so that you can easily encrypt data with a strong algorithm and large key. To do this you'd need to either convince MS or the NSA to sign your strong crypto, or remove the check in the CryptoAPI, much the same as crackers everywhere remove shareware expiration checks, etc.
It is possible to break a key (or any data) so that if there was n pieces one could choose that it requires at least n-x pieces to reconstruct the key. So having 10 pieces around the world and having a system that requires 8 of them to recontruct the key whould solve the both problems of loosing it to natural dissaster and compromising of key security. So either microsoft are wery stupid or it really is a NSA-key.
LINUX stands for: Linux Inux Nux Ux X
FRA: STFU GTFO
This kind of acronym-confusion happens all the time. Reminds me of the time when McDonalds ran out of payslips in the UK, and had to use a bunch of preprinted USA payslips. The US payslips had a box which noted contributions to the employee's Individual Retirement Account, which was naturally enough headed "IRA contributions".
The UK employees went berserk, assuming that McDonalds was inviting them to make contributions to the balaclava-and-bomb organisation with the same initials. The British Army had to issue standing orders prohibiting soldiers from organising boycotts of McDonalds.
jsm
Huh? I can't figure out the point you have. Basically, M$ is simply trying, despite US gov't stupidity, to sell what willing buyers want. If putting in a private authentifier for the spooks lets M$ sell, then they will follow the path of least resistance. not a moral stance, but a responsible one for their stockholders. As far as the gov't export laws go, they can't work, don't work and are a PHB solution - all sound, no substance. So weaseling around them, as you seem to accuse M$ of doing, is no big deal. No worse than setting up Apache on linux and not informing the upper management details on how the website was done (ie, not getting into pointless discussions on the use of "freeware"). You did what was explicitly asked, and kept the details from the ignorant. I find having to trust M$/US gov't for signed modules much MORE offensive than having a signing module that can be easily removed. Easy removability, IMHO is a feature, not a bug, as you seem to imply. If Bruce is correct, and he is an acknowledged expert on the topic, this was a no big deal. Deleting NSA key would simply mean that the NSA couldn't use your machine to run their private wordprocessing software the next time the black helicopters drop agents into your livingroom. SO the only issue left is this: how do you remove NSA key? It may be harmless, but I don't want it. and what other modules are available? (second question is out of curiousity) Best wishes
Uhhh, the Lotus Notes Internation version is as secure as other software approved for export as far as the NSA is concerned, it's more secure for everyone else to try to mess with.
Or are we proving once more that if you have enough money, you're above the law?
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
From the original article..
"Normally, Windows components are stripped of identifying information. If the computer is calculating "number_of_hours = 24 * number_of_days", the only thing a human can understand is that the computer is multiplying "a = 24 * b". Without the symbols "number_of_hours" and "number_of_days", we may have no idea what 'a' and 'b' stand for, or even that they calculate units of time."
...
"Then came WindowsNT4's Service Pack 5. In this service release of software from Microsoft, the company crucially forgot to remove the symbolic
information identifying the security components."
this doesn't mean that i acutally believe something like this could simply just "slip through to the public", but don't be so naive people. this is the government of the most powerful nation in the world. to think they don't have some form of control over a product which is a) originated in this country b)used in almost every country in the world and c) has the capability to "interfere with national security" is ludicrous. also, it appears to me that in most of the responses to the article people didn't really read the part i quoted above. if the allegations of microsoft "forgetting" to change their variable identifiers to ambiguous ones is actually true, then i believe this finding deserves some credit. however, i don't want to be naive as well and believe everything that i hear. examine all the facts, and think before you speak.
To answer question 1: Just about anyone has access to ALL of the NT Source. You should have seen the server(s) get slammed when this came out: everyone looked for it themselves.
If you don't trust Microsoft, you probably arn't using their software anyway. In any case, MS has lobbied extencivly against crypto controls. MS programmers are still programmers, not demons contemplating the destruction of all life, as some would have you believe. MS is made up of People.
#1 is correct, and I'm sure it's the main reason.
:).
#2 is incorrect -- all symbols were stripped, both _KEY and _NSAKEY. Symbol stripping is standard on executable releases; it reduces bulk and helps keep dirty names out of releases.
#3 is amusing -- you use the phrase "so many smarter things to do" and "Microsoft" in the same sentence. Face it, Microsoft has always been stupid. And getting bigger doesn't help -- the IQ of a group is equal to the minimum of the IQs of its members, divided by the size of the group (as a Debian user, I'm unhappy about that rule
#4 is just SO wrong it's not funny. Most every OS vendor, and many other software and hardware vendors, have deals to ship this stuff.
-Billy
I agree, the NSA isn't stupid. They know what they're doing. It just goes to show you what the media can do to the general public. They can suddenly publish a story about M$ being allied with the NSA and too many people believe it. I mean, I would never trust Microsoft, but I doubt they would ever do something like that. More likely, it's their *lack* of security that is linked to the NSA. Think about it, if nobody has any security, then the NSA can easily poke around wherever they please. They want to read someone's e-mail? Think Hotmail. Who knows. All I know, you can't fight them directly, so you gotta make yourself some unbreakable code.
Honestly, a majority of users seem to be getting worked up because of all the hype. It doesn't help that Linux users (me included) have the ingrained belief that Microsoft sucks, and derive much glee from this NSA business and the Hotmail crack. I'm glad to see that people are calming down from the screams of conspiracy; sometimes a cigar is just a cigar (or perhaps I should appeal to Occam's razor)
Personally, I'm quite the fan of the programmer's-joke theory: I've got one thing named KEY, I'm bored, I don't want to name it KEY2 or something equally boring, so why not slap "NSA" in front? Hmm, maybe I should slip "NSA" into the code I'm (supposed to be) working on right now...
--A
One way or another, I'd like to see who all's changed status on their payroll over the last week or so...
Dewey, what part of this looks like authorities should be involved?
The biggest unansvered question still remains: "Why are there two keys ?". So far Microsoft hasn't uttered a word of explanation that holds water.
They have admitted that the key is "to ensure compliance with the NSA's technical review". Either NSA wanted a second key or the MS software engineers didn't understand the review.
Microsoft has so far not offered any explanation of the second keys purpose that the first key doesn't already fulfill. Therefore, either they aren't telling the real truth or they fucked up the implementation.
Microsofts NULL statement can be found here: http://www.microsoft.com/s ecurity/bulletins/backdoor.asp.
--
Why pay for drugs when you can get Linux for free ?
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
I have to agree with Bruce's (and quite a few /. readers') take on this. If the NSA really did put a back door into Windows, they'd make damn sure no one could find it. Ever. That's why they're called "spooks".
Besides, with Echelon, they don't even need the back door......
NSA stands was ment to stand for "National Security Agency".
See:
http://www.microsoft.com/security/bulletins/bac
"The NSA performs the technical review for all US cryptographic export requests. The keys in question are the ones that allow us to ensure compliance with the NSA's technical review. Therefore, they came to be known within Microsoft as "the NSA keys" "
But what the real purpose of the second key is, we will propaply never know.
--
Why pay for drugs when you can get Linux for free ?
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
That sure is a big retraction from what he said earlier. I guess in the first article he implied what he is now denying he said. Think he got a call from a lawyer? I do. Mark
Howdy.
I like your theory. Hopefully it will get moderated up a few points (hint!)
:)
Here is my theory, which goes along with yours:
There is a small team of M$ programmers who take pride in the code they are crafting, and have worked hard to create a working Crypto API. At some point, the NSA sends around their "pressure tactics" team to influence how crypto modules get signed. These guys are good, without a doubt they have been trained in psychology and have rehearsed and play-acted the scenario many times and are now *VERY* effective at persuasion.
M$ management crumbles like a bunch of spineless wimps, giving in to every demand of the NSA, and then order the crypto team to implement a second key for the NSA, in effect nominating a second "root" CSP. You need to have a dual root system to do effective Revocation Lists, but it is not necessary.
So the programmers implement the second key, but chafe at being forced to do a weak crypto implementation. So they make sure the second root key can be replaced without breaking their crypto API, although replacing the M$ root key will cause a failure. They even give the variable the name _NSAKEY so others who maintain the code know what shit is going on.
Then someone in the software build group who pulls together all the source code from each project and does the compiles, forgets to strip symbols and the _NSAKEY symbol is left in the code.
Now the world knows it can rip out the second root key, and let windows fail the check with the first root and failover to the second. Now you can set up any strong crypto system yourself, but this is probably most useful for foreign banks and governments who can afford an expert to set up and test the system before rolling it out.
And the word gets out a little louder than before: U.S. crypto laws are there to make the NSAs job easier, not to protect american citizens or e-commerce or privacy or anything else.
But the best quote today from anonymous (finkPloyd) coward is:
Let's face it, if you are depending on Windows for security, you have more problems than the NSA
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Intresting comments from an even more intresting guy.
I got to meet him a the Neal Steaphenson Cryptonomicon book signing here in Minneapolis a couple of months ago.
I got him to sign my copy of Applied Cryptography. The signature was
OJNE
EHTY
KOOB
Now, how cool is that? Definately seems like the kinda guy I'd like to take out for some beers some time.
Hell, I started spouting off about my plans to wire my vintage telegraph key into my COM port so I could have a 'backup' for my e-mail program. He liked my idea and said to shoot him an e-mail when I get it working, he'd pay me to work up one for him too.
Just some after lunch ramblings.
So the question arises, is General Failure (he of reading your hard drive quite a lot in the bloatware) really a member of the nsa?
I was wondering about that too. I've always thought it was easier to compromise a person than crypto anyway, so it would be easier to just shell out moolah to a disgruntled someone instead of all the cloak 'n dagger shenanagins. I like the super secret naming of the key too - "NSAKEY" Gee, who's that for? Not the NSA, they're not that obvious.....
You think emacs is evil?! You've never used VM's XEDIT have you?!! That's evil, baby!
You are quite right, but are also reading far more into my post than I put there. As I said, for a two key system to make sense you need a secure way to switch the keys. Take a look at PGP's method for key revocation (note that it is recommended that a revocation message be generated WHEN THE KEY IS GENERATED). Now, the fact that apparently MS has no formal method for switching keys is why I described their implementation as "brain dead."
As for your first point, I agree. But if you had a secure way to switch between two keys, it would be a smart thing because you could keep signing things even in the event of a compromise and you would not have to get a new copy of the software with a new public key to everybody in order to do so. However, since MS's scheme trusts both keys, I agree with you that two copies of one key would be functionally equivalent.
I think what stinks is that MS is a closed source company. You can't know for certain what they are doing or why. You are only as secure as MS knows you. You, you have no idea. Yeah, I like that.
I would've at least considered tagging this with 'redundant'. The comments do not seem to contain any new evidence that we've not been able to distill from earlier discussion and the Microsoft press release, and the author's opinions aren't accompanied by any proof. I don't know the author's credentials, but you'll find as much speculation in any longer reply to a typical Slashdot article. Maybe as next step we'll get links on the main page to particularly interesting slashdot comments..
or treble bluff, quadruple blu...
Received SIGSEGV -- core dumped
-Yarn - Rio Karma: Excellent
He called the response by Microsoft (quote) "logical and satisfying at best for a first look" and calls for state institutions to use alternative operating system.
I love that thing about "alternative OS's" ;-)
This just shows again how Microsoft is content to dick around with the government and consumer alike.
Screwing the customer, by creating a secuirty mechanism that can be easily bypassed (if a replaces NSAKEY with a new one, then all your crypto modules can be replaced with insecure versions)...
On the flip side, they're blatantly disregarding the gov't's export requirements by allowing this key to be replaced abroad. So much for disallowing the export of strong crypto... They can just ship a weakened product and let people oversea's implement the changes.
No matter how you feel about encryption, privacy, etc... THIS IS A BAD THING. Bad for the consumer, bad for the government, and just bad policy. As we touched on in one of the previous discussions, why in the world did they need to create this "backup" key in the digital age?
I'd hope to expect that Win2000 ships with just a single key to compare signed code with, or at least bothers to check the signature of the back up key as well... Though I like the idea of myself being able to implement whatever cryptography I'd like, I don't trust anyone enough to go and implement new & imporved modules without my explicit approval
Third, why in the world would anyone call a secret NSA key "NSAKEY." Lots of people have access to source code within Microsoft; a conspiracy like this would only be known by a few people. Anyone with a debugger could have found this "NSAKEY." If this is a covert mechanism, it's not very covert.
I don't think this point is all that strong. Given that MS has made it possible for ANYONE to replace the crypto routines, arguments from "they aren't that stupid" don't hold any water.
---
Put Hemos through English 101!
"An armed society is a polite society" -- Robert Heinlein
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
Does a company have a moral obligation or fiduciary responsibility to the stockholders to circumvent it's "home" country's laws, misguided or otherwise, to maximize profits? How about other countries' laws?
The strength of encryption is based not on how big the keys are (sorry, but 32kbit keys are just plain unneccesary), but on how hard it is to get the plaintext, based on the crypttext and other known information. If the secrecy of your credit card numbers depends on other people not knowing the algorithm, or the implementation, of your encryption, then your encryption is pretty darn weak. Once the algorithm leaks out (due to espionage or hacking), your secrets are out.
The best encryption for one to use has five components working for it:
In the case of the CryptoAPI, we don't have an open-source implementation, nor do we know the details of the development of the CryptoAPI. Microsoft has all this information and isn't about to release it to anyone. Because of this, we don't know if the analysis of the CryptoAPI is sufficient. Therefore, we should consider Microsoft's CryptoAPI package untrustworthy.
Finding God in a Dog
I may be willing to accept your reasons (although jms suggests there is no such mechanism so I'm not real sure). But why didn't MS give this explanation then? At MS' site on the subject it says the key is specifically for disaster recovery. Not anything else. I really still don't understand why DR could cause the neccesity of this.
Your explanation makes sense though. Theirs does not.
-cpd
See this article at the Register for another reason why this "NSAKey" isn't a Big Brother threat. In short, it says that the NSAKey amounts to a useful hook for people to make their copies of Windows more secure and the NSA's job harder.
OTOH, the Register article seems to imply that the NSA screwed up in allowing the export of Windows with such a hook, which counters the "NSA is too competent to be this dumb" approach to debunking the idea that this is an NSA backdoor.
But, whether a mistaken approval or an incompentent backdoor, it doesn't seem to be much of a real threat. All in all, it's only proof of nefarious intentions if you assume nefarious intentions to begin with.
But if I talk like this much more, the other Libertarians won't let me come to local party meetings anymore...
Isn't it funny that this time it may be an honest misunderstanding on Mickeysoft's part the FUD is gonna work against it major time. Manager Type: NSA key? there's an NSA key? those are the big bad guys right?
Ladies and gentlemen, we apologize for this simple misunderstanding, but apparently the $NSAKEY was not, I repeat, was NOT, an NSA backdoor. After a thorough investigation and careful examination of all facts, it turns out that $NSAKEY was actually a weather balloon flying over some swamp gasses.
Previous reports to the contrary are false. Indeed, they never happened. In fact, I don't remember any previous reports to the contrary. In truth, I don't even know why I'm telling you any of this, because we have received no credible reports of an NSA Backdoor in any windows platform.
Next week we will start investigating reports that farmers are finding strong encryption algorithms burned into their crop fields. Until we discover more about this pheonomena, we are banning all crop exports immediately and reclassifying corn, wheat, and other grains as munitiions.
Thank you for your support in this matter.
Signed,
The Federal Government
Eviscerati.Org: All Hail the Eviscerati
Microsoft is right about one of the issues here. A backup key is useful for key loss. If the private primary key were lost in fire, flood, stolen, etc. and there were no backup, CryptoAPI would very quickly cease to be useful, as no newer encryption methods would be able to be implemented under CryptoAPI. This means taht a backup key is useful.
Microsoft has, apparently done some things wrong here, though. As I understand it, the reason the primary key can't be changed is that the default CSP is signed with the primary key, and changing this key would render the system unusable. Had a necessary component been signed with both the backup key and the primary key, and both signatures tested for that component, it would become more difficult to change the keys and retain a useful system.
The other thing that Microsoft has messed up here is the issue of key compromise. Microsoft has focussed entirely on prevention on this issue, excluding contingencies where the keys are compromised. They speak of hardware, software and physical security to prevent key compromise, but there does not appear to be a mechanism for key revocation if and when these security mechanisms fail, and the key _is_ compromised.
The NSA using MS software for National Security gives me Oh so much confidence...
As I understand ECHELON, it involves the UK, USA, Australia, and New Zealand as major players. Although it is illegal for the NSA to directly spy on US citizens, ECHELON removes this roadblock by allowing the data gathered on US citizens by our allies to be used by the NSA, and vice versa. I have some doubts about this whole NSAKey thing being genuine, but to say that it would be valueless or superfluous to the NSA (if true AND kept secret) is ridiculous. It would be far easier to use one back door in the OS that overwhelmingly dominates the market than it would be to keep trying to exploit security flaws that people keep finding and plugging. As far as cloak and dagger "turning" of a human agent, as has been suggested, well that leaves potential whistleblowers and witnesses. And it's only good for Company A or Organization B. But a master key that lets you peek into anybody's computer at any time? Well, if you were the NSA wouldn't you think that was a pretty handy little tool?
Paradoxically, Creationists do present good evidence against evolution: not their arguments, their existence.
mwood set up the credibility argument with his reminder about how Mom talked about reputations. The credential comments seem like a lazy mans way to address this.
flatrbbt emphasized this again but left me some questions to ponder. I hope responses to those questions grows further.
I could go on-and-on but the point I wanted to make was how markedly different this discussion is. The AC group seems to be on vacation and I want to encourage more factual discussion about this. I am going back into learn mode so keep the good stuff coming.
I've worked on a CSP. When you send it to Microsoft you don't have to send the source! You fill out a form describing algorithms used, etc (so they can evaluate the export requirements) but you provide your CSP in binary form (after all, they have to sign the binary). You don't ever have to let them see your source, and they don't check your implementation (for the reasons I stated before).
So if you want to make a bogus CSP you lie about the contents. Of course your customers can hold you responsible for lying about what you're giving them, but you may or may not care.
/* The beatings will continue until morale improves. */
Take a look at the Bugtraq archives. It ain't so hard to get a Windows machine to run exploit code. ASP holes, HTA holes, Java holes.
I have discovered a truly marvelous sig, unfortunately the sig limit is too small to contain i
This NSAKEY dosn't give the NSA any advantage
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
I agree it is just that simple, except...
Except it *does* allow the NSA to change your crypto. Whether they would want to or whether they have a better way in through another security hole is debatable. The real point is that it is unnecessary for you and I to have a NSA key in our copy of Windows.
I have discovered a truly marvelous sig, unfortunately the sig limit is too small to contain i
Yes, I'd say they are definitely more advanced than the average /.'er. To think otherwise would be pretty naive.
BTW, your comment about "they don't develop their own technology" is a bit off.
Yes, they use Crays -- but they also have super computers that they develop in house (in whole or in part). One notable one they call "The Thinking Machine" was specifically designed and developed for crypto operations.
Since Microsoft relies exclusively on prevntative security measures to protect the private key(s) from being compromised, any measure which would reduce this security is unacceptable. More copies of the key makes it more difficult to maintain security and ensure that the private key is not compromised (as opposed to lost).
The NSA got their own CSP verification key, because they want to be able
to change their own secret US government CSPs required for the handling
of classified documents, without having to go to Microsoft each time to
get a signature for an NSA CSP update.
....
Please apply a bit of simple critical thinking here:
If the NSA wanted to have real backdoor functionality, they would much
more likely simply steal Microsofts own keys instead of embedding
additional keys with an obvious symbol name. Remember: The NSA is the
world's largest key thief.
Well there's a contradiction here. If NSA uses Windows based systems to protect their secure data, how smart can they be?
Unfortunately, MS suffers from the same credibility gap as certain others do. The surest way to know they are lying is to check and see if their lips are moving.
Even after their answers, The questions remain.
Why are there 2 keys?
Why are the keys replacable?
Who has had access to them? aside from a hoarde of programmers doing daily builds.
Doesnt the daily build mean the two keys are stored in the same building?
Is only 1/2 oh this building "natural disaster proof"?
What happens now that the key locations are known?
How long before they are cracked?
Once they are cracked, cant I use ms_key to replace nsa_key?
Have your keys been replaced?
Will they be replaced again.
Can they be replaced via activeX/java?
All in all, I find the story without credibility.
The tone in his second writing does not support the tone of his first.
What changed his mind? Why is this such an insignificant security hole in comparison to the major hole at the time of the first writing?
Who convinced him otherwise?
I am sorry, but having listened carefully to this and other arguments presented by MS and its minions, I will need some convincing.
Until then, I will continue to recommend that all MS products be removed from "secure" corporate machines.
Steve Ruyle
Ex Libris Veritas
There's at least one thing Microsoft and Schneier are not kidding about - the MS CAPI verification keys DO NOT PROVIDE SECURITY, nor do they intend to. They enforce export restrictions.
If you send Microsoft a CSP which encrypts data by XOR'ing with a stream of zeroes they'll sign it as long as you have the appropriate license. They don't care, nor should they.
Think about it. If Microsoft were actually certifying that any signed CSP provided a good strong crypto implementation, then any customer who discovered a flaw in a signed CSP could sue. And would. Microsoft wouldn't even consider putting themselves in that position.
Therefore if I work for the NSA and I want to install a crippled CSP on your system, I ask Microsoft to sign it. And they will, no security questions asked. The only thing having my own key would buy me is not having to wait for them to get through the process.
/* The beatings will continue until morale improves. */
If the NSAKEY is there to support NSA, or put there at their own request, it's highly amusing.
:)
The one documented effect of the second NSAKEY is to defeat strong encryption control on Windows.
No matter which side of strong encryption debate you're on, Microsoft has probably lost reputation over this. Don't be surprised if an order for RedHat CDs arrives from Maryland...
Past evidence shows the NSA being a lot further ahead in the crypto game than the academic crypto community (and in turn, the academic crypto community is a lot further ahead than the average /. poster). The DES S-boxes are just one example. Times are changing, but if you asked me whether I'd use a cipher designed by the NSA or one designed by a Slashdot AC (yes, I know the irony) I'd pick the one designed by the NSA. Both of them will probably be readable by the NSA, but the reason that Fort Meade's cipher will be readable is a backdoor, not poor design. :-)
You don't understand Echelon or how NSA works. First of all, if the NSA is caught spying on a US citizen then they are in deep shit. echelon works by gathering all the data it can and then uses an alogrithm to pick out interesting bits from all the data. Its a lot easier to grab everything than to hunt for specifc thiings.
But why didn't MS give this explanation then? At MS' site on the subject it says the key is specifically for disaster recovery. Not anything else. I really still don't understand why DR could cause the neccesity of this. Your explanation makes sense though. Theirs does not.
I was wondering about that, too. Why would they give an explanation that clearly makes no sense? I think it's a PR concern. Talking about natural disasters is OK -- publically raising the issue of a compromised key is not.
What I'm listening to now on Pandora...
The true importance of this news item never had anything to do with practical matters of security. If you're concerned with and knowledgeable about computer security, you're probably not using Windows -- especially if you're trying to keep the NSA out.
The real issue is the effect this story will have on Microsoft's international image. They are already considered to be very Americocentric (as are many other American companies, to be fair). Remember Microsoft's refusal to produce an Icelandic version of Windows? They ticked off lots of non-Americans with that move, not all of them in Iceland.
The idea that Microsoft would truckle to the whims of an American intelligence agency only worsens the problem. It didn't turn out to be true, but people aren't going to remember that. They'll remember the accusation far longer than they'll recall the exoneration.
It sucks, but the truth just isn't an important factor in shaping public opinion. Microsoft lost big on this one.
--
Some keywords for the NSA in the Lord of the Rings universe: One Ring bind find Sauron quest Nazgul freedom
Let's face it, if you are depending on Windows for security, you have more problems than the NSA :)
Finkployd
I think really sensitive information might be stored on a windows machine if that was what they wanted for the job at hand.
The security is more likely to be enforced through no network connection, being in a metal room so that no electormagnetic signals can escape, and simply never allowing any recording media of any sort to leave the room once it has entered. Beepers, cell phones, and other electronic devices will also never enter and especially never leave that room. Really secrete places probably have filters on the power or their own power supply so nohting can escape over that channel either. No modem will be left in a computer connected to a live line (there is probably not a live telephone line in the room) so no trojan process can dial out in the middle of the night and up load stuff.
The secrete data can then be manipulated with whatever software you want. Given such a situation, how would you steal data ? You might slip them a messed up copy of something so they'd loose their data or otherwise sabatoge the effort, but there is no channel for you to receive information on the outside.
Hey all,
;-)
OK, people have been saying 'It *must* be the NSA' for this Microsoft 'key'.
Now, there are a lot of conspiracy theorists out there that would say this is the NSA. There are even more that believe in the coverup of Roswell et al. Some even believe the X-Files is real...
Here's a thought - IF the Government is so powerfull and has been so good at keeping secrets, how come they are pretty inefficient in comparasin. Surely if the Government was able to keep all of these things secret and so effeciently then why do we still have crime on the streets ? Why are there still the unemployed... makes you think...
As I think a couple of other people have said, is it not plausable that a MS programmer thought of a name for a key and then thought of the NSA... bet he's laughing if he did... otherwise we better start to worry
Everybody starts out as an amateur. Bruce Schneier isn't an amateur any more.
...phil
...phil
"For a list of the ways which technology has failed to improve our quality of life, press 3."
>>"NSAKEY" Gee, who's that for? Not the NSA, they're not that obvious.....
Of course, if everyone didn't take it seriously because they believed that it was "too obvious" and that it "couldn't be true," then it could be even more powerful than if it were kept secret.
Just a conspiracy nut theory... Personally after reading through all the commentary and articles it just seems to be a bit of sensationalism. The buffer overflow security flaws in IIS is a much larger security risk than this issue....
HaXXXor.com - Naked Chicks Teach You How To Ha
If you use Open source, you just have to read the code. simple. faster and more elegant.
JYA.COM posted a link to a different MS response. It said something different -- perhaps this was the marketing dept reply? ;)
I read the last few paragraphs as "The NSA required it, we put it in, don't worry -- it won't hurt you".
see:
http://www.microsoft.c om/presspass/press/1999/sept99/rsapr.htm
---------------------------------------------
Microsoft Says Speculation About Security and NSA Is "Inaccurate
and Unfounded"
REDMOND, Wash. - Sept. 3, 1999 - Microsoft Corp. said today that
speculation about Microsoft® Windows® security and the U.S. National
Security Agency (NSA) is "inaccurate and unfounded."
In response to speculation by a Canadian cryptography company that
Microsoft had somehow allowed the NSA to hold a "backdoor" key to the
encryption framework in its Windows operating system, Microsoft issued
the following statement:
"This report is inaccurate and unfounded. The key in question is a
Microsoft key. It is maintained and safeguarded by Microsoft, and we
have not shared this key with the NSA or any other party.
"Microsoft takes security very seriously. This speculation is ironic since
Microsoft has consistently opposed the various key escrow proposals
suggested by the government because we don't believe they are good
for consumers, the industry or national security.
"Contrary to this report, the key in question would not allow security
services to be started or stopped without the user's knowledge."
Microsoft said the key is labeled "NSA key" because NSA is the technical
review authority for U.S. export controls, and the key ensures
compliance with U.S. export laws. The company reiterated that
Microsoft has not shared this key with the NSA or any other company or
agency.
Founded in 1975, Microsoft (Nasdaq "MSFT") is the worldwide leader in
software for personal computers. The company offers a wide range of
products and services for business and personal use, each designed with
the mission of making it easier and more enjoyable for people to take
advantage of the full power of personal computing every day.
Microsoft and Windows are either registered trademarks or trademarks of
Microsoft Corp. in the United States and/or other countries.
Other product and company names herein may be trademarks of their
respective owners.
Note to editors: If you are interested in viewing additional information
on Microsoft, please visit the Microsoft Web page at
http://www.microsoft.com/presspass/ on Microsoft's corporate
information pages.
-----------------------------------
Well, according to http://www.milk.com/wall-o-shame/gray_men .html, the NSA is a couple of centuries ahead of the rest of the world in maths theory ;)
Then explain to em exactly why the Crypto API is used...why not just lock the door...???
-Shane Stephens
There is a mechanism for key revocation... they can just upgrade the OS. Over time the old key would be increasingly difficult to use despite having been compromised.
Since the keys are cryptographically secure, the most likely scenario is not that the key would be compromised by a hard-crack, but by someone within Microsoft who works with the private key (signing packages) and who decides to give it to someone who asks nicely.
Microsoft would (I imagine) immediately post a service patch which (among other things) removes the old key, and replaces all of the old crypto modules with new ones. The new modules would then work everywhere (even on unpatched machines), but the old modules would only work on old machines, which would gradually become obsolete. Since there isn't any way to force people to accept a certificate revocation, this seems as reasonable a way as any to manage such a problem (at least to me.)
LibBT: BitTorrent for C - small - fast - clean (Now Versio
Eeerm - no, I don't think so...
There's still one major flaw in that argument.
Third party crypto modules (signed ones) would immediately stop working. Oops!
-Shane Stephens
Ok hows this for a conspiracy theory.... For every pro conspiracy theory comment on slashdot I've seen for this article, there have been twice as many articles debunking the conspiracy theory. Now from the past, I know that the number of conspiracy theory proponents on slashdot is in no case a minority. So do you think some one is trying to make us think this is just a big misunderstanding...???
Even better, NSAKEY happens to be an anagram for SNEAKY.
The difference between theory and practice is that, in theory, there is no difference between theory and practice.
Many of you apparently view this comment from Schneier as some sort of vindication of Microsoft. I see it in quite another light. Before I criticize the man, let me clarify that I have read his book and that I do greatly admire him.
Those who have observed that Schneier's press release adds little to the discussion are correct - nearly. True, he says nothing that has not already been said several times elsewhere, including a regurgitation of the Microsoft party line and some humorous commentary on the inappropriate name this key received in the debugger.
But he does add something. He adds a snide and technically unjustifiable comment about Microsoft cryptography, implying that it is deficient:
Microsoft has two keys, a primary and a spare. The Crypto-Gram article talked about attacks based on the fact that a crypto suite is considered signed if it is signed by EITHER key, and that there is no mechanism for transitioning from the primary key to the backup. It's stupid cryptography, but the sort of thing you'd expect out of Microsoft.
This is not the "sort of thing" I'd expect out of Schneier. He behaves as though he has never heard of a Certificate Revocation List. CRL's are fully implemented in Internet Exploder (although for sound connectivity reasons online checking is turned off by default. see Tools|Internet Options|Advanced) CRLs are not only an adequate means of revoking compromised public keys, they are an internet standard.
Schneier's article appears to contribute nothing to this discussion other than an unjustified punch below the belt. I admire the author of Applied Cryptography too much to let this attack pass without voicing my disapproval. Schneier has already made his name. He has nothing to gain from pinching the schoolyard bully and then running away.
-konstant
-konstant
Yes! We are all individuals! I'm not!
It was another site, I think it was the CCC, but I'm not sure. we were also reading what was probably a bad translation from german as well.
in any event, I agreed with this guy, and was *amazed* at all the people who didn't even really take into consideration what was happening. I mean, they just jumped right on the band wagon. I'd be willing to bet that a lot of the posters didn't even bother to read the story...
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
man youre a twit. it took me 10 seconds. 20 MINUTES ?? jeez.
Given two opposing stories, the truth often lies somewhere in the middle. MS on one side says it's a backup Key, and this article suggests it a key for NSA to do the signing themselves. Lets throw together some wild thoughts and see where it goes...
/etc/passwd?)
a) Several people have commented that it is possible for the key to be replaced and load other "signed" crypto modules.
b)MS cut a deal to enforce signing crypto modules, to enable them to export windows. If NSA wanted to load modules without MS, they'd need a key.
c) People were initially scared that this key would allow NSA to install modules on their machine.
d) The keys are actually used to verify crypo before loading, if it passes the signature, it'a trusted and will be used.
Would the NSA not be equally scared of someone signing a crypto module and getting it loaded and trusted on their machine? Now think, windows is exported worldwide, and if this article is correct, then so is the NSA public key. How likely is that? (Hint: which is easier to detect, a online hacker trying to logon directly, or a remote hacker cracking your
So, what if this key was just inserted as a "placeholder" and within NSA, there is a "hardening" program which replaces the placeholder with their own. This could explain
a) That MS would indeed have access to the second key (ie the "backup")
b) That NSA do load crypto signed by themselves
c) Why it was called an obvious name, as it was meant to be replaced later.
Fun to think about, eh?
--
Exigo spamos et dona ferentes
We're talking about the single largest employer of mathematicians in the world. Although I'd imagine the gap has dwindled as more people get into the field (when I was at Brown, at least two professors in the math department were actively doing crypto-related research), it seems likely to me that the NSA is still at least three years ahead of the civilian research world.
Only a guess, though. The NSA knows, but they aren't telling.
I didn't know what a meme was, so I asked five friends. They didn't know what a meme was, so they asked five friends.
This is all speculation, but it seems to me that the smart way for a company to do something like this is to use a smart card. That way nobody knows the private key -- it's stored in the tamper-proof card. You don't have to worry about an employee (or NSA spook) stealing a look at the key someday. It can't be copied.
If done with a smart card, you have to physically possess the smart card to sign anything (it has an onboard processor you feed data blocks to). My guess is that Microsoft keeps the main smart card locked up on their campus and the backup smart card locked away in a bank vault somewhere.
As opposed to Unix - paragon of security awareness these last 25+ years. What a frigging joke.
The NSA did not do this: Microsoft did this. It did it to cause fear, uncertainty and doubt about the U.S. Government in foreign markets. Microsoft wishes the world to put pressure on the USA to back off on Microsoft. On the one hand there's the antitrust case (GEE, DO YOU SUPPOSE DISTRUST OF GOVERNMENT WOULD PLAY IN THEIR FAVOR?), and on the other hand there is encryption restrictions, and in order to be in a position to effectively fight Unices and Linux internationally, Microsoft has to be allowed to ship encryption anywhere they like, including to enemies of the USA. After all, those enemies can use Linux: stopping Microsoft from doing business with enemies of the USA means getting in their way and impeding their business.
This is a trial balloon for a new geopolitics: it says in BIG RED LETTERS, "hands off Microsoft, USA". It's not a message for America- it is a message for the rest of the world. "Look! Unless something is done, the worldwide monopoly on computers and communications will be a tool of the USA! Wouldn't you rather it was just a worldwide monopoly beholden to nobody, with no loyalties at all?"
I must say I've been expecting this: I've been certain for some time that MS had no loyalty to the USA at all, and that they would find a way to cut the apron strings. It's typically ruthless MS marketing that the way turns out to be casting fear, uncertainty and doubt at the NSA by a childishly transparent ploy. Nothing that I've ever heard about the NSA suggests that they would tell MS to build in a key for them, allow it to be named 'NSAKEY', not _check_ to see if MS did it right etc etc etc. That's ludicrous- competent or incompetent they are too _paranoid_ to allow themselves to be betrayed that stupid way, therefore it's not them (and they probably have YA-key that nobody knows about, knowing them).
Since it's not the NSA which laid that carefully planted clue, and since it came from somewhere inside Microsoft, the question becomes "Why would Microsoft produce such a clue to cause fear of the NSA?" and I think what with the antitrust case and the blocks against exporting encryption, it should be quite obvious why Microsoft now sees fit to backstab the U.S. Government itself.
1st) I didn't mean to say the average /.'er but was too lazy to type out a full word. In a rephrase, are they that much more advanced than freelance computer scientists? I think not.
2nd) I was under the impression that they simply "overtook" the thinking machine from a seperate corp. claiming it was illegal...not sure where I read that, but oh well, wouldn't be the first time something I've read was inaccurate.
It is possible for a "middleware" product like the CryptoAPI to be insecure, but not likely. I still wouldn't trust Microsoft's own encryption modules though (the ones actually CALLED by CryptoAPI). For one thing, a good PRNG to get randomly-distributed keys is VERY hard to write. I just finished writing one because every distributed PRNG that I came across produced predictable keys (meaning that you don't have to brute force all possible keys to break the encryption, just the keys produced by the pseudo-random number generator, which proved not to be so random!). I seriously doubt that Microsoft got the PRNG right, and Bruce Schneier's own "Yarrow" PRNG is perfect proof of that (Bruce has a paper on his site, www.counterpane.com, detailing attacks on a PRNG that will let you crack encryption in MUCH less time than a pure brute-force attack).
-E
Send mail here if you want to reach me.
I'm sure you're right that the NSA wants that. However, the way they would _GET_ that is either asking Microsoft to give them MS' secret key so they can write their own codes, OR secretly replacing Microsoft's public key with their own on the computers they're using (after all, there is no reason to continue using MS' key).
Don't forget Without MS's Key, windows can't varify *itself* and the OS won't work at all (at least that's what they've been saying). I'm sure the NSA *could* do somthing to rev-eng windows, and rewrite all that stuff, but it would be a lot less work for them to just work with MS to begin with
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
It *doesn't* not really. while it's possible for them to *release* crypto modules if they really want, they can't just type in your IP address and change your crypto around. The keys are only used to load code Already on the system. If they really needed to install something I'm sure they would want to do more then that (think back orifice).
also, since it would require you to run executing code, even if the 'NSAKEY' weren't there, they could conceivably add it to the system
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
Critical mass.... There were enough british scientists who knew enough about nuclear fission that they had independently calculated the critical mass of U-235 long before 1945. The critical mass of the implosion bombs, Trinity and Nagasaki were somewhat more complicated as it depended on the spontaneous fission rate of the Pu which depends on how good your purificaiton and reactors are.... The British knew all of the technology for the bomb as soon as we did. What they did not have is the capital and raw materials. After the war, the US forced a deal upon them to trade their sources of Uranium for economic aid, which they needed desperately to rebuild. All of this is in Richard Rhodes' books. What *IS* true is that the extensive atmospheric testing of the H-bomb did provide enough information (via the isotopes produced) to Andrei Sakharov and others in the Soviet Union for them to verify the key design feature of the fusion bomb. The H-bomb design was in fact classified until the mid-90's. The key idea--soft x-ray radiation driven implosion of a tube of fusion fuel, with fission driven explosion from the inside, was considered a huge breakthrough by the US, and government officials didn't believe anybody else would think of it for 20 years. It took the USSR 2.
There were enough british scientists who knew enough about nuclear fission that they had independently calculated the critical mass of U-235 long before 1945.
The critical mass of the implosion bombs, Trinity and Nagasaki were somewhat more complicated as it depended on the spontaneous fission rate of the Pu which depends on how good your purificaiton and reactors are....
The British knew all of the technology for the bomb as soon as we did. What they did not have is the capital and raw materials. After the war, the US forced a deal upon them to trade their sources of Uranium for economic aid, which they needed desperately to rebuild.
All of this is in Richard Rhodes' books.
What *IS* true is that the extensive atmospheric testing of the H-bomb did provide enough information (via the isotopes produced) to Andrei Sakharov and others in the Soviet Union for them to verify the key design feature of the fusion bomb.
The H-bomb design was in fact classified until the mid-90's. The key idea--soft x-ray radiation driven implosion of a tube of fusion fuel, with fission driven explosion from the inside, was considered a huge breakthrough by the US, and government officials didn't believe anybody else would think of it for 20 years. It took the USSR 2.
The NSA can't install it remotely, whatsoever. Even Active X applets from Microsoft need to be authorized before they can be used.
They keys are only used to verify Stuff already on the system
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
Can someone explain the MS response? Why do they need the backup? If you have a natural disaster where the primary key is held then the backup key would be used which is held at a different place. Why not just have 2 copies of the primary key? I hope there is something obvious that I don't see.
-cpd
well i think that maybe the nsa didnt put this key
now if it has other maybe , i think that hte keys are there for what ms wants and not what they say
peronaly i dont like the idea of letting ms have any key control in an os. the "back up key" idea was altough thought full it can be used as an exploid , and i dont trust ms enuf to tell me the truth. sorry it is just me being paranoid
This whole issue has been fun to watch. When I read the first message about how Microsoft had the NSA key in Windows, I kinda wondered if they would really do that.. Couldn't really decide either way.
But the number of people that read it and instantly assumed it was true was astounding. I've had friends ask me out of the blue about it. I've heard of it through mainstream media. I've seen story after story about it.
Most of the the media people still won't admit it was jumping to conclusions. That's what really bothers me. They're mostly sticking to the "well Microsoft says it's false but who can know for sure" lines to cover their own asses (and credibility).
A Wired story says "Questions lingered Friday over whether or not security experts overreacted to a scientist's charge that Microsoft built a backdoor in Windows for a US spy agency to enter". Isn't it fairly clear that they overreacted? Or is this going to happen again the next time?
(If it's a real issue, like the Hotmail thing, then they deserve to get slammed... but come on, let's verify this stuff before we go nuts).
I agree with the other poster.
Hmmmm....with Echelon, the NSA would really have no need for a backdoor to Windblows; but then gain; how hard is it to crack Windblows?
The NSA has some of the best crypto/math folks; so you really need to ask yourself if they would leave something so obvious. They are a little more adept than that.
Bruce Schneier:
- Wrote "Applied Cryptography", the best introductory book to the field of cryptography and cryptanalysis;
- Wrote the Blowfish algorithm;
- Wrote with others the Twofish algorithm, one of the finalists of NIST's new Advanced Encryption Standard
There is a lot more. Look around the site...
...That the NSA simply wants to install their own
damn 22nd century crypto modules without
having to e-mail them to Microsoft to get
them signed.
Which is what Bruce is saying.
I honestly think it is just that simple.
-- cary
1) 'Lots of people have access to source code within Microsoft;' - maybe, but most people have only access to code they develop, in fact only a handful of people have 'full' access. Even fewer people have access to the keys themselves. The Caldera antitrust suit brought up some very interesting Microsoft-internal documents that have relevance now: a dozen DOS engineers were reassigned to work on making DrDOS 'as incompatible as humanly possible'. 'Normal' DOS engineers did not even know about this team, the team's real duty was only known to the vice president (Brad Chase in this case). And DOS only had a couple of tenthousand lines of code - with NT's millions lines of code it's not at all hard to 'hide' activity and shield off even top developers from 'the realities of RL'.
2) 'It's called "NSAKEY" for some dumb reason' - yeah, and the symbol name got stipped off from _all previous shipped Windows releases_ (a couple dozen ones, not including localized versions), while $KEY was not stipped? You got to be kidding. $NSAKEY within a crypto module means only one thing.
3) 'There are just too many smarter things they can do to the unsuspecting masses.' - face it, the Microsoft monopoly is valuable to the signal interception community in this regard: it's everywhere. You will not find a single piece of software more widely installed.
4) What was the deal Microsoft cut with the NSA which (uniquely amongst OS vendors) enables them to ship a Crypto API. Crypto-enabling APIs are explicitly forbidden by US export controls, even if they do not ship strong crypto. What was the 'deal' with the NSA?
--Coke
Any tier-1 sensitive info isn't going to be on any OS that you've ever heard of.
2) 'It's called "NSAKEY" for some dumb reason' - yeah, and the symbol name got stipped off from _all previous shipped Windows releases_ (a couple dozen ones, not including localized versions), while $KEY was not stipped? You got to be kidding. $NSAKEY within a crypto module means only one thing.
Only one thing? Those of us who don't jump immediately into paranoia mode can picture M$ engineers, having to name the thing, laughing their asses off when they realize what will happen when conspiracy junkies see the name and using it as a gag.
There are other, even goofier possibilities, not to mention the quite reasonable ones brought up on NTBugTraq.
It's gotta go in the code somewhere, man.
I think it is entirely plausible that the NSAKEY is there to allow the NSA to install CSPs for their own use without microsoft have to sign them. Only one thing that makes me wonder. I think it is a safe assumption that the NSA either reviewed the CryptoAPI code before it was release or certainly after the product shipped to make sure that it worked as advertised. I mean the point of the whole system is to keep higher bit encryption from being exported. Since there is no check on NSAKEY and it can be replaced with any key allowing any CSP to be installed, the whole thing is useless. Either the NSA is completely incompetent or something else is going on.
The purpose of the CryptoAPI was to enforce U.S. export controls. The failover to the second key, which can be poked with your own public key (as described in his earlier Crypto-Gram article), means that this mechanism is broke broke BROKE. Like so much else in MS's crypto suite. Sigh.
Read his Yarrow paper and you'll get the context for his comment that it's easier to attack MS's PRNG (pseudo-random number generator) than it is to attack their encryption directly.
-E
Send mail here if you want to reach me.
TELL me you dind't put something humorous in your code. TELL me you didn't. I've got one program that has in it:
const int answer = 42;
JUST for the hell of it. Some Microsoft programmer somewhere is laughing his ass off that he got ALL of you to fall for this..
Magnwa
They put Zimmerman through the ringer by not performing due dilligence and 'allowing' PGP to get out of the country. Zimmerman didn't export PGP - some other 'criminal(s)' did.
Now MS screws up and lets strong crypto out of the country - and THEY are the entity exporting this 'munition'. Where's the FBI?
And if the NSA required MS to implement the second key, aren't they accomplices in this crime of exporting strong crypto?
A fellow graduate student from England told me a story a few years ago about American Intelligence and the atom bomb. The Manhatten Project was our top top secret; we wouldn't even tell our allies about it. However, when the device was detonated, possibly over Hiroshima, the U.S. government gladly distributed time elapse photographs of the expanding mushroom cloud: What a historic moment! What an achievement! From this little bit of information British scientists, and possibly others, were able to deduce the critical mass of U238.
People are careless, dumb and vain: one of the reasons security through obscurity is a bad idea.
I don't believe that the "NSAKEY" allows the NSA to read everyone's email that's encrypted with Windows - that was always an exaggeration. But it's clear that Microsoft are holding something back, because they have not produced a credible account of why the second key is there.
All they say is "in case the first key is destroyed". To which we all say "so why not take a backup"? And after that, it's all *sheer speculation* on our parts about what their actual reasons are, for example about whether they mean "compromise" rather than "destruction" (hint: volcanoes don't compromise keys) or whether there's some other need that backups wouldn't meet. It's speculation because Microsoft haven't told us. All I know is:
* Microsoft have not come up with a believable explanation of why there are two keys, either of which can validate a CSP
* And *neither has anyone else*, not Bruce Schneier, not Markus Kuhn, not any of the people on the mailing lists I'm on. No-one has suggested anything that would make this an even vaguely sensible way to do things, let alone a way past an NSA security review.
Frankly, if I hear a non-fishy explanation for this I'll be quite likely to believe it - it's true about Microsoft's historical stance in favour of strong crypto, even though the whole CryptoAPI signing thing rather goes against that in the first place. Until such an explanation surfaces, though, there's no reason at all to let Microsoft off the hook on this one.
--
Xenu loves you!
But the certificate revokation lists have nothing to do with the keys that verify the validity of the CSPs.
Schneier makes disparaging comments about the general quality of MS's cryptography because he (and mudge) have done analysis of several Microsoft security implementations and found nearly all of them seriously flawed.
I'm waiting for their analysis of NT5's EFS.
If you're intrested in better random numbers on the intel platforms check out: http://developer.intel.c om/design/chipsets/rng/techbrief.pdf I belive that there is a way to get Hardware, true random numbers from newer pentiumX CPUs.
Also check out http://developer.intel.com/de sign/chipsets/rng/docs.htm for more info.
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
Attempt to hack a persons account. Try passwords of 'secret', 'password', their birthdate, spouses birthdate, anything on a postit note on their screen. If that fails, phone up said user and say "Hi i'm FooBarSmith from MIS, I need you're username for delousing the terminal BMR-fubar queue." If they still don't give you their password, cough, tell them it's it is fixed and phone up another person in marketing. bah NSA backdoors ;)
stty erase ^H
There has to be a hierarchy of trust for these to be proper CRLs: ie, less priviledged keys have trust delegated to them by more priviledged keys, so the more priviledged keys can later revoke that trust by signing an appropriate CRL. Both keys are as trusted as each other and can replace themselves or each other.
Schneier's analysis is quite accurate.
--
Xenu loves you!
2) It is silly of them to call it NSA_KEY, but in all previous versions the label was removed. In the latest service pack it was left in, apparently by mistake.
No conspiracy maybe, and it's a good point that for the NSA a backdoor like this is pretty much superfluous. But let's not cut them more slack than they deserve.
If it is an NSA key, I love the irony--since it enables a simple utility to disable the export protection for the cryptoAPI.
From BugTraq. It's not on their archive (yet) at www.securityfocus.com, but will be soon:
:)
From: Markus Kuhn
Subject: Re: NSA key in MSFT Crypto API
The actual funny story behind the presence of the NSA key has been
seriously misunderstood here. CSP verification keys have only one *real*
purpose: They are intended to enforce the US export restriction
requirement that Microsoft is not allowed to ship software abroad that
can easily be extended with strong cryptography. They are certainly not
intended as any useful form of integrity protection for your system.
The NSA got their own CSP verification key, because they want to be able
to change their own secret US government CSPs required for the handling
of classified documents, without having to go to Microsoft each time to
get a signature for an NSA CSP update. Fair enough. So Microsoft built
in a second verification key such that the NSA can produce and install
on DoD PCs their own CSPs without requiring any Microsoft involvement.
The real funny part is that Microsoft did not protect the NSA key
particularly well, such that everyone can easily replace the NSA key
particularly well, such that everyone can easily replace the NSA key
easily with his own key. This was reported by Nicko van Someren at the
Crypto'98 rump session. This means that everyone can now easily install
his own CSPs with arbitrarily strong cryptography. This means that the
NSA's demand to get quickly a second key added led in effect to the easy
international availability of strong encryption CSPs. My guess is that
this is Microsoft's sweet revenge against the NSA for creating all these
Export hassles (e.g., the requirement that CSPs be signed) in the first
place. It backfired nicely against the NSA.
All this has nothing to do with an NSA backdoor, because the CSP keys
are an export enforcement tool and not an integrity protection tool.
They do not protect all parts of the system that could be compromised by
someone who wants to install some eavesdropping malware. The CSP
verification keys only authenticate that no cryptography that violates
export laws has been installed. If you are worried about the NSA
installing malicious software on your PC, you should not rely on the CSP
verification keys (which were never designed for that purpose anyway),
but on virus scanners with tripwire functionality that report any
modifications to your DLLs. There is no digital signature functionality
required to implement these, simple secure hash algorithms will
perfectly do.
Please apply a bit of simple critical thinking here:
If the NSA wanted to have real backdoor functionality, they would much
more likely simply steal Microsofts own keys instead of embedding
additional keys with an obvious symbol name. Remember: The NSA is the
world's largest key thief. They have stolen crypto variables from
well-protected military and government agencies from all over the world
using the usual repertoire of techniques (bribery, extortion,
eavesdropping, hacking, infiltration, etc.). If they can do it with
eastern military agencies, they can most certainly also do it easily
with Microsoft, which is orders of magnitudes less well protected than
the usual NSA target. If there is a real NSA backdoor key in Windows,
that it would certainly be identical to Microsoft's own key.
Markus
I can play the speculation game, too. Spooks may not choose the obvious paths of least resistance, because they're too obvious. When it comes to rogue bureaucracies, you can't take anything for granted.
I can see the fnords!
Just in case you cant figure out the code...
"Enjoy the book"
Took me about 20 mins to figure it out.
Very cool.
I'm just curious as to why everybody seems to think that the NSA is so far advanced over the typical /.'er. Granted they have a large budget, they don't develop the technology, they simply pay others to.
So sure they may have thousands of cray super computers, but I doubt they have something so powerful as to blow us away with.
They are, after all, people to.
I, too, would tend to believe the NSA wouldn't be so blatant as this. But, one has to take Microsoft's position on a backup key tonge-in-cheek.
The argument that they keep the primary key in one facility and the backup key in another just doesn't hold water. Sounds like a nice disaster recovery policy, but not realistic as a true disaster would destroy the primary key.
Hasn't Microsoft heard of distributing the key via an n-threshold key algorithm? Heck, the algorithm is in the public domain and published code can be found in Bruce's book, "Applied Cryptography".
Counterpane Systems
Counter Pane Systems
Now, counter means against ,or anti. Pane is something found in windows.. as in a pane of glass... Ergo.. (And if you take the Latin it'd prolly be MUCH more humorous)
Anti..windows.. systems?
Neat. :) Magnwa
(Subject line says it all.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
The earlier poster didn't understand why you'd need to have a backup key. If you used a key held by a smart card, then you couldn't just keep a copy of the bits somewhere. You'd have to have a separate card with a backup key.
Anyone think that NSA might be someone's initials? Maybe a Microsoft employee... or an honorary link to Neal Stephenson (NS)? Just a thought...
Linux: Because rebooting is for adding new hardware.
He said that they could get MS to sign NSA's modules-- I doubt if they'd want MS in the loop. Think of all the people who suddenly become involved and could talk later.
The NSA does not require a _NSAKEY in *all* the world's MS windows, only their internal ones. They would use a utility such as the one posted to simply change MS's key to their own.
Attacking a random number generator would be one of the first things I'd check if I was paranoid enough and writing my own encryption software. Hell, why not bypass MS's random number generator all together?
Sure one can break into Windows and do all sorts of nasties. These points of entry could be found out too by hackers and publicized.
If I was running the NSA and had my morality chip off line (you should in that case all be scared silly), I'd have *many* diverse points of access into MS products, not just one or two. This allows for flexibility of attack and robustness given the slow evolution to more secure OSs.
I'd also get some of my pals deeply involved in Linux, and *BSD but thats another story.
cheers all.
That long?
-- 73 de KG2V For the Children - RKBA! "You are what you do when it counts" - the Masso