Re: MSoft crypto API's

At 07:19 PM 7/9/96 -0400, George Kuzmowycz wrote:
>  The June 10, 1996 Network World carried a story on page 8 under the 
>title "Microsoft breaks crypto barrier", which starts off as follows:
>
>  " Microsoft Corp. last week said it will include cryptography-based 
>security technology in its operating systems, messaging product and 
>Web browser through a new set of APIs that will be available both in 
>the U.S. and overseas.
>
> " The fact that the National Security Agency is allowing Microsoft 
>to export the cryptographic APIs is somewhat of a coup for the 
>software vendor, although the NSA did nothing to alter the current 
>export ban on strong encryption."
>
>  Later on, it says:
>
>"  Microsoft's Crypto APIs will be available to third-party vendors
>writing applications with embedded security. But the hardware or
>software Crypto-engines for these applications will need to be
>digitally signed by Microsoft before they will work with the APIs.
>Under an unusual arrangement with the NSA, Microsoft will act as a
>front man for the powerful U.S. spy agency, checking on whether the
>vendors' products comply with U.S. export rules."

Unexplained:   What if the program Microsoft is asked to sign is not 
intended for export?  Presumably, NSA has no authority, then, and thus 
presumably Microsoft shouldn't be able to refuse to sign anything they're 
asked.

Question:  Doesn't this set up an action by Microsoft which would be 
actionable under anti-trust laws (if it wasn't done at the behest of 
government?)


Couldn't somebody IMPORT a piece of encryption software, have it signed by 
Microsoft, then take the XOR of the signed and unsigned software and export 
it?  (It's not a tool capable of encryption...)

Or:  Microsoft presumably has foreign branches, or at least it could easily 
afford to set up one.  What's to stop Microsoft from signing foreign 
encryption software outside of the US?  The software is never exported 
(since it's already outside the country...), so there's no USA-law involv
ement.
Jim Bell
jimbell@pacifier.com

It's even easier than that. Remember, signatures are detachable from the 
data. You import the software, MS signs it, you export the signature, and 
reattach it to the software.

						Mike

> Couldn't somebody IMPORT a piece of encryption software, have it signed by 
> Microsoft, then take the XOR of the signed and unsigned software and export 
> it?  (It's not a tool capable of encryption...)
> 
> Or:  Microsoft presumably has foreign branches, or at least it could easily 
> afford to set up one.  What's to stop Microsoft from signing foreign 
> encryption software outside of the US?  The software is never exported 
> (since it's already outside the country...), so there's no USA-law involv
> ement.
> Jim Bell
> jimbell@pacifier.com
>

-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 9 Jul 1996, jim bell wrote:

> Date: Tue, 09 Jul 1996 20:34:11 -0800
> From: jim bell <jimbell@pacifier.com>
> To: George Kuzmowycz <gkuzmo@ix.netcom.com>, cypherpunks@toad.com
> Subject: Re: MSoft crypto API's
> 

[stuff moved to /dev/null]

> 
> Couldn't somebody IMPORT a piece of encryption software, have it signed by 
> Microsoft, then take the XOR of the signed and unsigned software and export 
> it?  (It's not a tool capable of encryption...)
> 

Hrmm.. at this point I am reminded of when mit.edu refused to allow my
brother to ftp the non-international version of PGP...

To make a long story short, he promptly received the exact same file from
a .de server.

> Or:  Microsoft presumably has foreign branches, or at least it could easily 
> afford to set up one.  What's to stop Microsoft from signing foreign 
> encryption software outside of the US?  The software is never exported 
> (since it's already outside the country...), so there's no USA-law involv
> ement.
> Jim Bell
> jimbell@pacifier.com
> 
> 

Perhaps the real question is this... Can MS reliablt develop a working and
secure encryption package that we should all trust in the first place?  I
doubt it, and I'll wager so does the NSA if you catch my drift...

 --Deviant


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMeNvDDAJap8fyDMVAQG0cAf+MXQEE3sFOoymJOhnTegox58TK5Tc+iZj
xK3qWObTvFwOTPzs0n9dgI60EJfxjjVmwiEvDWZQaNzxgxyCXLS6FFwrV8WHC5vT
/HxGnskCU3gNTpDh5S2nsJk0Huhmj5snE1ViETIgyN9i1dUKt/KCHM+TXDOQvyd0
V25NnDgzHG6dVcLE7ATAoa/1p2XobEFB/ZOgiInYVr+tEO8EzIY3eoKKoOJ92le0
JrirB3NfXGBfEoajp34azxBs6549EKCqLI5vjfzNoMRFHVqKpmSJZLVwMTIOJ4Ks
HE123I5xXx3heQrdNtzeg/m8XRKOko6HYkBrwNjgoO1+qW23LU89CA==
=pCQy
-----END PGP SIGNATURE-----