Re: Cryptonym - Research

[Jim Langston <jlangston@xxxxxxxxxxxxxxxx>]

What would you expect Microsoft to say?  "Yeah, we violated the security
of your operating system"?  Of course not.  But, reading
the story and what
Microsoft actually said:

But Microsoft said it's not, and calls the incident a "tempest in a teapot."
Instead, Windows NT security product manager Scott Culp said the company was merely complying with federal rules imposed by the U.S. Commerce Department and NSA to meet export control requirements. Culp said the keys have been used for years to verify the digital signatures of partner companies using its crypto application programming interface (API), and to verify that they're export approved.

"They're in there because that's how we comply with export controls that the NSA is overseeing," he said.

Okay, so Microsoft is saying, We only did what the NSA made us do.  But, they are not
quite explaining what the NSA made them do.

Culp states that keys have been used for years to verify the digital signatures... but doesn't
state what else they may be capable of.

To me this sounds like, "We put it in because the NSA made us do it." and are not really
explaining what "it" is.  And the NSA is saying, Talk to Microsoft about it.

It sounds exactly like explained.  The NSA didn't have luck with the Clipper chip, so they
did it in software instead.

Actually, though, has anyone looked at Pentium chips?  Maybe the NSA got the Clipper
chip installed anyway.

Regards,

Jim Langston

Terry Richardson wrote:

> This sounds to me like another urban legend spawned by the Consumer Paranoia
> Institute.  I'm not the only one who thinks this-check out this link.
> http://www.zdnet.com/zdnn/stories/news/0,4586,2328464,00.html
> <http://www.zdnet.com/zdnn/stories/news/0,4586,2328464,00.html>
>
> Terry Richardson
> Sr. P/A
> The Orvis Company, Inc.
> 802-362-8663