Hack Lotus?

-----BEGIN PGP SIGNED MESSAGE-----

I have no doubt that enterprising hackers will be able to hack
the international version of lotus Notes to make it as secure
as the domestic version. It is probably just a matter of NOPing
some code.

The real problem is the 64 bit key in the domestic version. This
conforms to the NIST "standard" for an exportable system. In other
words to allow the international people to have almost non-existant
40 bit security, they have limited domestic users to 64 bit secuity.
The 64 bits keys must be breakable at least in some sense or the limitation
would not be in the NIST "standard".

The 64 bit keys are probably allocated in structures and stack allocations,
so the hacking past the 64 bit limitation will probably be extremely difficult
and error prone! (To increase the size of data in a structure or data on the
stack means moving all the data beond it. This means increasing the memory
allocated and changing all references to data beond the data whose size is 
increased.) To do this in a patch, may be difficult.

In any case, I do not trust the code any large company if I do not have
the source code. Big companies are too subject to presure. What we really
need is a hack to completely substitute our own external code such as PGP!

- -- 
Paul Elliott                                  Telephone: 1-713-781-4543
Paul.Elliott@hrnowl.lonestar.org              Address:   3987 South Gessner #224
                                              Houston Texas 77063

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: cp850

iQCVAgUBMQbe8fBUQYbUhJh5AQHDoAQAg9eWu4aJrhQ87n+JqxfTjCOJKEKm8Bfr
J9Gggh/jnzW1MY4ApjOtQes7sHR5+66i43E4nUnN0CJYyD+aMCjbJEhwLPU4uHy2
1nF36X0vCYe0+4uSrebW/eMpFBj6fFrVbrmF8tiGD2VrqSQ2Fda00PY9erKKD2KN
GTmeqFL/QVY=
=SDNt
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----

Paul Elliott writes:
> The real problem is the 64 bit key in the domestic version. This
> conforms to the NIST "standard" for an exportable system. In other
> words to allow the international people to have almost non-existant
> 40 bit security, they have limited domestic users to 64 bit secuity.

The 64-bit domestic limit really has no connection to the 40-bit intl. limit.
It would be just as easy to build the intl. version of Notes with 128-bit+spy
keys, with 40 bits of truly protected key and 88 bits of espionage-enabled 
key, and then use straight 128 bits in the domestic version. They simply 
appear not to want people in the U.S. to have >64 bits of security, 
regardless of export issues.

Futplex <futplex@pseudonym.com>		Still drowning in mail....

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMQhrTSnaAKQPVHDZAQGPIQf+J1HO2onogc8tbaFFobWtv1K68wFmYqfl
6vb4OUxHyxuaow2QwbFXiOY3gUQZ61yCRhTgc6IcZOzJG0pBEXBV5B/Hb3fVdWJX
0L31f5/rzYIMsR0cnnEhMI6QtjtZC6V4MDlTnVuDjW/CBbMyWizEj/73dJTS5OxH
ekghkkvyObe6RbQTij/f3YVt+NYE94kiI/j9PXaq+n9mLJp4GID11EodD9Lwu3hD
Z2dA8kPcSagh1uT0SdQcyB/mYML2VhiBY13alPci20+UXfgot+8hSG7c8yUtcKrW
AmgtKI3/JLa5BwWcVC5XrvEX/L8xwzUB4FKCWUKhA5/+xiv8Kvxhdw==
=VQIm
-----END PGP SIGNATURE-----