Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

_NSAKEY

en.wikipedia.org

Post reply on HN
Print view View original

111–118 of 118 posts

Re: _NSAKEY

#111

Post by ta999999171 »

smolder wrote: post #97
tribaal wrote: post #70

Earlier quoted context omitted.

I think that's the point the comment you are replying to made: if it was legitimately a microsoft key that just serves a different purpose, it would be trivial for microsoft to prove it by just signing a message or anything with the corresponding private key. The fact that they haven't reinforces the argument that they don't own the private key (likely, the NSA does as the conspiracy goes)

> (likely, the NSA does as the conspiracy goes) Pardon my pedantry but I think you meant conspiracy theory . Conspiracies happen all the time, and by itself the word doesn't imply anything far-fetched or unproven, just plotting to do harm.

At least someone's allowed to point it out.

Maybe next time I'll write a paragraph shrugs

Time for me to find another community.

Re: _NSAKEY

#112

Post by ryanlol »

Sean1708 wrote: post #107
peter_d_sherman wrote: post #86

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Nicko_van_Someren Excerpt: "Van Someren has published numerous papers in the field of computer security. In 1998 he co-authored a paper[13] with Adi Shamir introducing the concept of key finding attacks. A statistical key finding attack was used by van Someren to locate the signature verification keys used by Microsoft to validate the signatures on MS-CAPI plug-ins. One of these key was…

I'm not entirely sure what your point is here, but the fact of the matter remains that the key that is being referred to in ryanlol's quote is not _NSAKEY.

So what is _NSAKEY for then? Does anybody know?

Re: _NSAKEY

#113

Post by ryanlol »

xg15 wrote: post #110
CrazyStat wrote: post #26

Earlier quoted context omitted.

Windows used _NSAKEY (and another key) to check that Cryptographic Service Providers are signed. Otherwise it wouldn't allow them to be used. This was explained in the article.

Ah, apologies. I didn't catch that part.

Although, this still fails to explain the mechanism via which such Cryptographic Service Provider would land on your computer (assuming this is still supposed to be a backdoor).

Re: _NSAKEY

#114

Post by Sean1708 »

ryanlol wrote: post #112
Sean1708 wrote: post #107

Earlier quoted context omitted.

I'm not entirely sure what your point is here, but the fact of the matter remains that the key that is being referred to in ryanlol's quote is not _NSAKEY.

So what is _NSAKEY for then? Does anybody know?

From the Wikipedia page:

> Microsoft said that the key's symbol was "_NSAKEY" because the NSA is the technical review authority for U.S. cryptography export controls, and the key ensures compliance with U.S. export laws.

People have speculated elsewhere in the thread about why they need a second key to be compliant, but as far as I'm aware we don't actually know.

Re: _NSAKEY

#115

Post by ryanlol »

Sean1708 wrote: post #114
ryanlol wrote: post #112

Earlier quoted context omitted.

So what is _NSAKEY for then? Does anybody know?

From the Wikipedia page: > Microsoft said that the key's symbol was "_NSAKEY" because the NSA is the technical review authority for U.S. cryptography export controls, and the key ensures compliance with U.S. export laws. People have speculated elsewhere in the thread about why they need a second key to be compliant, but as far as I'm aware we don't actually know.

I wonder if this just suggests that there’s nothing interesting to know.

“the _NSAKEY backdoor” would still make an excellent blackhat/defcon talk today if someone could actually demonstrate its existence and explain practical exploitation.

On the other hand “I looked and couldn’t find anything” isn’t really a very meaningful or interesting statement.

Re: _NSAKEY

#116

Post by smolder »

ta999999171 wrote: post #111
smolder wrote: post #97

Earlier quoted context omitted.

> (likely, the NSA does as the conspiracy goes) Pardon my pedantry but I think you meant conspiracy theory . Conspiracies happen all the time, and by itself the word doesn't imply anything far-fetched or unproven, just plotting to do harm.

At least someone's allowed to point it out. Maybe next time I'll write a paragraph shrugs Time for me to find another community.

I don't understand this post.

Re: _NSAKEY

#117

Post by ta999999171 »

smolder wrote: post #116
ta999999171 wrote: post #111

Earlier quoted context omitted.

At least someone's allowed to point it out. Maybe next time I'll write a paragraph shrugs Time for me to find another community.

I don't understand this post.

I was being somewhat subtle about my bitching re: my comments being killed that pointed out the same thing.
Post reply on HN