Computer Security Weekly, September 13, 1999


The biggest news in PC security in the past couple of weeks is the NSAKEY for Microsoft's CAPI (Cryptography Applications Programming Interface). This story is truly byzantine.

The base facts appear to be these. Microsoft has a cryptographic API that allows developers to produce a product, have it signed by Microsoft, and then have it accepted as a valid security program by versions of Windows. There is one primary key embedded in the Windows program. At the request of the US NSA (National Security Agency), there is a backup key, held in a file called NSAKEY.

Rampant and unproven speculation has it that the NSA supplied the NSAKEY, and that the NSA can use it to spy on computers, or to send out trojan programs that would be accepted by Windows.

The official response is that the backup key is generated and held by Microsoft (likely), and that it can be used as a backup if the original key is lost (unlikely). (By the way, the official page at Microsoft, while generally good, seems to demonstrate a very serious misunderstanding of cryptographic and security concepts in a couple of places.)

Security experts believe that the most likely use of the NSAKEY would be to repudiate and replace the primary key if the primary key were ever to be cracked, but this scenario also has problems.

Many security experts agree, however, that the NSAKEY can be replaced by another key from another source, and that this fact could possibly be used to attack the entire Windows security system.

http://cnn.com/TECH/computing/9909/03/wi... http://www.cryptonym.com/hottopics/msft-... http://www.cryptonym.com/hottopics/msft-... http://www.microsoft.com/security/bullet...

Another RSA factoring challenge has fallen. RSA-155, using a 512 bit key, has been factored. The job required about half a year using the combined efforts of a large number of computers. While the successive challenges are taking longer to do, I can recall reviewing a book a few years back which predicted that a 512 bit key would not be factored in our lifetime.

http://www.usatoday.com/life/cyber/tech/... http://www.rsa.com/rsalabs/html/factorin...

The US government's experts keep telling it to relax export controls on encryption, but it hasn't been listening. The President's Export Council Subcommittee on Encryption is the latest to join the bandwagon. However, don't hold you breath.

http://www.wired.com/news/print_version/... 21471.html?wnpg=all http://www.cs.georgetown.edu/~denning/cr... http://tbtf.com/archive/1999-08-16.html#... http://tbtf.com/archive/1999-08-23.html#...

DNS (Domain Name Service) is one of the major protocols underlying the reliability and functioning of the Internet. Windows 2000, and it's Active Directory service, rely on a newer Dynamic DNS. When W2K starts being added to mixed systems, some problems are starting to be seen. This
The copyright of the article Computer Security Weekly, September 13, 1999 in Computer Security is owned by Robert Slade. Permission to republish Computer Security Weekly, September 13, 1999 in print or online must be granted by the author in writing.

Go To Page: 1 2 3 4

Articles in this Topic    Discussions in this Topic