10 ms·
NSA's Backdoor Key from Lotus Notes
- javanix 13y agoWould they really put the NSA director's email in the PGP key? Something smells fishy about this.
- pronoiac 13y agoThey didn't. To quote: "(of course I made this user id up -- you can edit it to whatever you choose it's of course not self-signed)"
- s0rce 13y agoquote from the article: "of course I made this user id up"
- deleted 13y ago[deleted]
- rattray 13y agoWhy is this comment being downvoted? It was an honest, albeit rather silly mistake, not a misuse of HN.
- Pitarou 13y agoIt's an irrelevant remark from somebody who didn't read the article properly. Downvoting: - reduces the prominence of low quality content - encourages posters to avoid posting low quality content
- anonymfus 13y ago>This page has also been translated into Russian here It is not in Russian. It's in Belarussian.
- mietek 13y ago> and into Polish here This is, at best, an odd machine translation.
- fdb 13y agoThe translation is a sneaky SEO technique. People offer to translate your page into other languages as long as you link to the translation on their page. By linking to them, you pass on PageRank. The website has of course nothing to do with your content.
- jamesaguilar 13y agoI may be willing to believe the NSA are misguided, but nobody uses the bad guys' name for themselves on purpose. The NSA used Minitruth as the name of their backdoor? Gimme a break.
- EthanHeilman 13y agoThis isn't a rumor or some strange conspiracy this is just how crypto-export controls were done for a short while in the US. http://www.heise.de/tp/artikel/2/2898/1.html http://www.heise.de/tp/artikel/2/2898/1.html http://catless.ncl.ac.uk/Risks/19.52.html#subj1 http://catless.ncl.ac.uk/Risks/19.52.html#subj1 >but nobody uses the bad guys' name for themselves on purpose. Why not, I've heard of software teams naming themselves Cobra from GI Joe.
- ianterrell 13y agoI'd rather not be spied on at all, but if someone's reading my emails I sure hope they have a sense of humor.
- thesagan 13y agoI don't know, The darker side of me gets a kick out of it, really. It's interesting language to say the least.
- gcb0 13y agoThis is a joke on the implementation. I bet only the lotus devs ever read those names before.
- cbs 13y agoI assumed it was the work of the programmer tasked with installing the key for the NSA, not some self-deprecating humor.
- Havoc 13y ago>The NSA used Minitruth as the name of their backdoor? Gimme a break. More like the guy charged with implementing it had a sense of hunour / clear perspective.
- acqq 13y agoAlso from these times: http://en.wikipedia.org/wiki/NSAKEY http://en.wikipedia.org/wiki/NSAKEY An example of coverage, very similar to what we read now: http://www.whale.to/b/ms.html http://www.whale.to/b/ms.html
- deleted 13y ago[deleted]
- nijk 13y agoIndeed, under informed observers whipping a conspiracy theory frenzy because they don't understand technical details that contradict their theories.
- mpyne 13y agoThe NSAKEY entry was actually recently posted here...
- pyre 13y agoRead Schneier's take on it: http://www.schneier.com/crypto-gram-9909.html#NSAKeyinMicrosoftCryptoAPI http://www.schneier.com/crypto-gram-9909.html#NSAKeyinMicros... It seems reasonable that NSAKEY wasn't an NSA backdoor meant allow them to secretly install compromised crypto libraries on your machine.
- acqq 13y agoIt was obviously made for NSA. Otherwise the name wouldn't mention NSA. Microsoft didn't need the backup key, they were able to back up the single Microsoft key. Nobody designs the crypto with two keys accidentally. How NSA used it we can only speculate, but it was there on purpose, the truthful wording of Microsoft was "it was there for us to obey the law."
- apapli 13y agoGiven many companies running notes push forms out to their web site, I am curious, does now knowing this key increase the vulnerability of Lotus Notes servers everywhere as theoretically anyone can use it now?
- gcb0 13y agoNope. Those are called public for a reason. And if you are working with online business, as i guess for you being here, i highly recommend you read at least some introduction on PGP.
- stan_rogers 13y agoThat applies to versions of Notes and Domino prior to R5.0.4, since which there has only been one version (outside of France, at least, which didn't authorise import until October 2000 -- that's due to France's crypto import regulations at the time, not the USA's crypto export regs). This back door ceased to exist more than a dozen years ago, and the current international key length is more than 64 bits (4096 bits for users/servers, 8192 bits for certifier ids).
- krenoten 13y agoInteresting article, but slight quibble: differential cryptography is a cryptanalysis technique, ie a method that anybody can use to try to break a cipher. http://en.wikipedia.org/wiki/Differential_cryptanalysis http://en.wikipedia.org/wiki/Differential_cryptanalysis
- EthanHeilman 13y agoThis is differential work factor cryptography rather than differential cryptanalysis. Differential work factor cryptography is design crypto systems are easier for one party to attack. http://www.purecommerce.com/dictionary/ecommerce/differential_work_factor_cryptography.cfm http://www.purecommerce.com/dictionary/ecommerce/differentia...
- krenoten 13y agoAhh interesting, I wasn't aware of this use of the term. Thank you for the clarification!
- cocopanda 13y agoShould I be worried about looking at this.
- YeahWhateverMan 13y agoYeah, but who fucking cares anymore. Like, based on the events of the past week, I think we can all agree that whatever you're paranoid about right now, they've already far exceeded and overstepped your pedestrian low-ball estimates for what might be excessive, and in reality it already happened a decade ago, so you're just worrying about spilled milk.
- mpyne 13y agoFar more than a decade ago. I mean Jesus, you kids act like the government has been slowly and monotonically eroding privacy rights since 1789. :) Go read about the Church Committee Go read about HUAC. Go read about when we locked up the Nisei. And I'm not saying any of this to justify anything that's happening today. What I am saying is that IT'S BEEN MUCH WORSE BEFORE, and we STILL FIXED IT ANYWAYS. This isn't a ratchet-and-pawl fixture. Don't like something in the government? Go fix it! But stop acting like it's already been set in stone, or that everyone in government is the enemy of the people advancing some Illuminati conspiracy. By and large they're trying to do the right thing for the nation, who have interests far beyond what Greenwald or Michael Moore or Glenn Beck or Rush Limbaugh feels is important on any given day.
- acoleopteus 13y agoStill, the first step to fixing it is being upset about it.
- mpyne 13y agoAnd at the same time, you will never fix anything by being upset about everything. Even Ray Ozzie mentioned in the other thread that there are actual reasons a small-scale covert project would need to be secret to be effective, try getting some of the other hacktivists here on HN to admit even that. They can't, because they are blinded by their rage. My thought is that having some modicum of historical background on actual oppression can help with controlling emotion and enabling logical thinking.
- nijk 13y agoHas this story been verified by anyone else with a copy of Notes? This sort of thing would be a good homework assignment in a CS class.
- jrockway 13y agoIf I were a programmer that wanted to damage the reputation of my employer, I'd embed a key in its software that made it look like the software was sending all user data to the NSA. Any denial would meet "well, there's a secret law making you deny it". The perfect crime...
- acjohnson55 13y agoSomehow, I don't think the NSA would look kindly on that, and who knows how that might affect you. Not exactly the perfect crime.
- jrockway 13y agoWhat consequences do you envision?
- ttrreeww 13y ago"Dissapeared"
- jrockway 13y agoHas any programmer ever disappeared after writing code that pokes fun / ire / controversy at the NSA? Has anyone in the US ever disappeared after something like this? I guess we can imagine a new world where up is down and white is black, but in the current world, the government is just a bureaucracy filled with bureaucrats trying to get promoted for coming up with crazy ideas. Disappearing random people is not high on anyone's agenda, I don't think.
- ttrreeww 13y agoI donno, I lost contact with a lot of former people, they seem to have disappeared. I'm sure you too.
- rozzie 13y agoRay Ozzie here. Regarding "minitruth" - you've got to maintain a bit of a sense of humor when things get stressful. It was such a long time ago, but one thing that clearly differentiates our efforts in those days vs. what's been reported in the news in the past few days is the issue of transparency. The day we shipped the "differential workfactor" implementation in Notes, I keynoted the RSA Conference and gave a speech laying out what we did and why. Charlie Kaufman, a great cryptographer who worked for me, also distributed a paper he wrote with the technical details. You can find my speech and his paper buried in here if you're interested. (search for "lotus.notes") http://web.textfiles.com/ezines/HWA/hwa-hn19.txt http://web.textfiles.com/ezines/HWA/hwa-hn19.txt And if you're really motivated to understand what it was like during the Crypto Wars, go read Steven Levy's book "Crypto". http://www.stevenlevy.com/index.php/books/crypto http://www.stevenlevy.com/index.php/books/crypto Back to the present - it pains me to see such a lack of transparency in how our elected officials are running our government. Of course, the common man knows it's common sense that there's an inherent need for secrecy in conducting small scale covert operations. We do get it. However, it's also common sense that it's inevitable that any complex large-scale long-term operation will ultimately come to light. And so it's just common sense that any such broad-based operations that might be perceived as impacting our constitutional rights should be the subject of broad public debate. No, not when they're being prototyped or tested or used in small scale settings - but definitely somewhere on the path from "tactical use" to "broad strategic dependence". These are not small issues, nor need they be at all partisan. Wyden, Paul, and others are trying. Theses issues are fundamental to defining the relationship between us citizens and our government in the decades ahead. In particular, in this world where "SaaS" and "software eats everything" and "cloud computing" and "big data" are inevitable and already pervasive, it pains me to see how 3rd Party Doctrine may now already be being leveraged to effectively gut the intent of U.S. citizens' Fourth Amendment rights. Don't we need a common-sense refresh to the wording of our laws and potentially our constitution as it pertains to how we now rely upon 3rd parties? It makes zero sense in a "services age" where granting third parties limited rights to our private information is so basic and fundamental to how we think, work, conduct and enjoy life. For example, did you really intend to yield your 4th amendment rights when you granted a 3rd party access to your files as a part of Mac Software Update, Windows Update, Virus Scanners, etc., or when you started using a service-tethered smartphone? Anyway, unlike 'web tracking' issues which seem to be broadly ignored because of our love for ad-supported services, I hope we all (especially the young readers of reddit, hackernews, etc) wake up to the fact that these privacy and transparency issues are REAL, and that they truly will impact you and the country you live in, and that even if you don't consider yourself an activist you really should get informed and form an opinion. Again, this is a non-partisan issue, and let's all work to ensure that it stays this way. Two great organizations where you can learn are EPIC and EFF. (Disclosure: I am on the board of EPIC.) Take it in, and think. Your contributions are needed and would of course be quite welcome. http://epic.org http://epic.org http://eff.org http://eff.org
- TheYComb 13y agohttp://support.citrix.com/article/CTX116557 http://support.citrix.com/article/CTX116557 Getting the private key is as easy as having a smart person inside the company that works for both the company and the gov. Then you just have to sit on a router and read the traffic. Relatively simple for a gov agency. There are 2 ways to be safe: 1) You do not use any technology. 2) You are honest in everything you do. The second one is probably the easiest.
- scaramanga 13y agohmm, I was expecting to see that they'd factored the private key. It's been done before for 768bits RSA and presumably both NSA and RSA are picking good semiprimes but maybe not eh? That would be interesting to know.
- BruceLi 13y agoWelcome to China!