Re: NSA and Netscape Crack

At 3:46 PM 9/19/95, Jim Ray wrote:
....
>I don't expect to know NSA's specific brute-force capability, but
>does anyone know if the NSA has *ever* found a glaring weakness in
>software and then told its author(s) or owner(s) about it? Do "we"
>perform the "COMSEC" role Tim was speaking of better than the NSA?
>JMR
....
Once upon a time NSA would find weeknesses in friends' crypto systems and
tell them about it -- depending, of course, on the situation. It was a
reciprocal practice. We don't know that NSA didn't tell Netscape.

In article <ac85fa9f010210046fb1@DialupEudora>, norm@netcom.com (Norman Hardy) writes:
> At 3:46 PM 9/19/95, Jim Ray wrote:
> ....
> >I don't expect to know NSA's specific brute-force capability, but
> >does anyone know if the NSA has *ever* found a glaring weakness in
> >software and then told its author(s) or owner(s) about it? Do "we"
> >perform the "COMSEC" role Tim was speaking of better than the NSA?
> >JMR
> ....
> Once upon a time NSA would find weeknesses in friends' crypto systems and
> tell them about it -- depending, of course, on the situation. It was a
> reciprocal practice. We don't know that NSA didn't tell Netscape.

  As far as I know the NSA did not tell Netscape anything about this
RNG vulnerability.  If they had we would have fixed it immediately and
put up a patch.  Believe it or not we don't like being trashed for
being stupid all over the net, print media, and TV.  As far as I know
the NSA have not given us any advice about how to make our system
stronger.  I've heard rumors that they were quite upset when they
learned that SSLs 40-bit RC4 was actually 40-bit secret and 88-bit salt.

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.

| Believe it or not we don't like being trashed for
| being stupid all over the net, print media, and TV.  As far as I know
| the NSA have not given us any advice about how to make our system
| stronger.  I've heard rumors that they were quite upset when they
| learned that SSLs 40-bit RC4 was actually 40-bit secret and 88-bit salt.

It is dangerous that the general reaction is that of
'them being stupid', since that will prevent others
from stepping forward and reveal their own 'holes'.

I decree that 'all holes look stupid once located'.

But 'any non-trivially large program is bound to have
holes' => 'all programmers are stupid' (except me,
because I found the hole?)

Jeff, your and Netscape prompt response to this is
what counts - holes will always be uncovered, it's the
time before they are patched that really matters.

/Christian