>This was not a secret back door. It was compliance with export controls everybody in the industry dealt with. The author states it correctly. Here is the text

>This was not a secret back door. It was compliance with export controls everybody in the industry dealt with. The author states it correctly. Here is the text from the author "The idea was that they got permission to export 64 bit crypto if 24 of those bits were encrypted for the NSA's public key. The NSA would then only have the small matter of brute-forcing the remaining 40 bits to get the plaintext" Here is the text from the RSA conference. Hello, 1st off please don't publish my name on your site. I'm too lazy to set up another cheezy mail acct. Today I downloaded cryptography/nsa/lotus.notes.backdoor.txt from your site. I have a close friend who is a developer for Iris (the people who make Notes for lotus.) I sent him the file I downloaded and asked him what the deal was, and here's his response: Here's the necessary info to truly understand the issue here; a speech by Ray Ozzie and Charlie Kaufman's white paper on the topic. What it comes down to is that notes provides superior exportable encryption technology when compared to other US products on the market. For anyone (but the NSA) to crack our international encryption keys they must crack a 64 bit key, the same as with a US encryption key. In the international version we take 24 of the 64 bit encryption key and encrypt the 24 bits with the NSA's public key and send it, encrypted strongly, along with the encrypted message. This means the NSA can decrypt with their key and have 24 of the 64 bit key. They still have to break the remaining 40 bits. 40 bit key encryption has been the max for exportable encryption and that is what all other US exportable encryption providers allow. That limit has just been raised to 56 bits and we are incorporating that as I type. In the worst case: the NSA's private key is compromised, the 40 bit portion of the key still must be cracked. So we haven't weakened the security of international encryption, but actually made it equal to the US security (to everyone but the NSA). We are proud of this arrangement because we have found a way to make Notes as secure as the US government will allow for our international customers. If we hadn't used this technique all of the international notes encrypted data would be with only a 40 bit key. As it stands, the 64 bit key used in both US and international encryption is extremely secure. It's too bad the author of this article choose to attack Lotus Notes without considering the options the US government provides. We could have just shipped 40 bit encryption like MS, Netscape, etc. and leave our international customers with weak encryption but we didn't. Oh well, you can't make everyone understand, this confusing and frustrating stuff. I hope this helps.