Full Strength Stronghold 2.0 Released Worldwide

For Release May 5, 1997
C2Net Software: Douglas Barnes +1 510 986 8770
UK Web: Dave Williams +44 113 222 0046 

	   Full-Strength Stronghold 2.0 Released Worldwide
     C2Net President Sameer Parekh Rejects Weak Keys, Back Doors

Oakland, CA - C2Net Software, Inc. annouced today the worldwide
availability of Stronghold 2.0, a major upgrade to their secure web
server based on Apache. With this release, Stronghold has added more
functionality than ever, including uncompromised security, web-based
configuration, and new protocol support.

"The Stronghold web server -- like all C2Net products -- supports
full-sized keys, and will never support government back doors," said
C2Net president Sameer Parekh. "We have development teams around the
globe working on our products, free from US export control
policy. Even if some of these countries cave in to US demands, we'll
still be able to produce first-rate, uncompromised security products."

Others Use Compromised Security

In a recent announcement, Netscape Communications announced plans to
include government back doors in their products. "By implementing this
so-called 'key recovery', Netscape is getting a small increase in key
length in exchange for putting your keys in the hands of the
government," said Parekh. "This the same government that hired Aldrich
Ames, the same goverment that has IRS employees surfing taxpayer
databases at will. What do you think is going to happen to your keys?"

According to cryptography expert Bruce Schneier, "There is absolutely
no business case for key recovery. Any benefit you get from longer key
lengths is offset by the enormous security risk of concentrating keys
in a few hands."

Current "export" versions of Netscape and Microsoft web servers use a
weak 40-bit cipher that can be broken in hours by any bored systems
administrator or college student with access to a few hundred idle
machines. By comparison, all C2Net software can use at least 128-bit
keys.

To understand this difference, imagine that the hundreds of computers
needed to crack a 40 bit key in a few hours were compressed into a
cube an inch on a side, and you built a computer the size of the Earth
out of these cubes, it would still take this computer more than four
times as long to crack a 128 bit key. It's easy to find a few hundred
computers idle at any medium-sized business or university; Earth-sized
computers are still relatively uncommon.

Stronghold Gaining Market Share

In several recent surveys, Stronghold has emerged as a leading
contender in the web server market. An O'Reilly and
Associates/Netcraft survey of secure web servers in use on the
Internet found that Stronghold was second only to Netscape. The
monthly Netcraft survey of all web servers on the Internet has
indicated for some time that Stronghold is also the second most
popular commercial web server for the Unix platform.

"We've been steadily gaining market share," indicated Parekh, "and to
a great extent it's due to our firm stand that we won't sell
deliberately weakened security products to our customers."

Features in Stronghold 2.0

"We've redesigned the security interfaces and built on the new Apache
1.2 code base," commented Mark Cox, Stronghold product manager at UK
Web. "Stronghold has had many productivity and performance
enhancements and it is now fully compliant with the new HTTP/1.1
standard." The HTTP/1.1 standard is a significant update to HTTP/1.0,
the protocol that governs how web browsers and web servers
communicate.

HTTP/1.1 brings many new features to the table, including improved
content and language negotiation, improved persistent connections, and
better recovery from interrupted transfers. (For more information on
HTTP/1.1, see http://www.apacheweek.com/features/http11)

Stronghold 2.0 also includes a web-based configuration manager,
allowing web administrators to securely administer their sites from
the web browser of their choice. "We've had a lot of requests for this
feature as Stronghold has grown in popularity," said Douglas Barnes,
C2Net Vice President.

On the security front, the new release includes support for Secure
Sockets Layer (SSL) version 3, which provides stronger security and
more flexibility in choosing ciphers.

Background

UK Web Limited is a leading Internet services company specialising in
server technology, Internet security, business solutions and effective
site design.

C2Net is the leading worldwide provider of uncompromised network
security software.

Netscape Navigator and Netscape Enterprise are trademarks of Netscape
Communications Corporation. Microsoft Internet Explorer and Microsoft
Internet Information Server are trademarks of Microsoft Corporation.
Stronghold and SafePassage are trademarks of C2Net Software, Inc.

Portions of Stronghold were developed by the Apache Group, and were
taken with permission from the Apache Server http://www.apache.org/.
Stronghold also includes software developed by Eric Young
(eay@cryptsoft.com).

sameer <sameer@c2.net> writes:

> For Release May 5, 1997
> C2Net Software: Douglas Barnes +1 510 986 8770
> UK Web: Dave Williams +44 113 222 0046
>
> 	   Full-Strength Stronghold 2.0 Released Worldwide
>      C2Net President Sameer Parekh Rejects Weak Keys, Back Doors
>
> Oakland, CA - C2Net Software, Inc. annouced today the worldwide
> availability of Stronghold 2.0, a major upgrade to their secure web
> server based on Apache. With this release, Stronghold has added more
> functionality than ever, including uncompromised security, web-based
> configuration, and new protocol support.

Remember: if you comment on the fact that one can't examine this
product's source code for security holes, you'll get threatening
letters from C2Net's lawyers: Helena Kobrin, Cantor, & Siegel.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

-----BEGIN PGP SIGNED MESSAGE-----

on or about 970504:2140 dlv@bwalk.dm.com (Dr.Dimitri Vulis KOTM) expostulated:

+Remember: if you comment on the fact that one can't examine this
+product's source code for security holes, you'll get threatening
+letters from C2Net's lawyers: Helena Kobrin, Cantor, & Siegel.

    attila sez:

    well, as far as I am concerned, bully for Sameer's lawyers. anyone 
    who does not provide source code for an [in]security product, 
    particularly one based on an open source product HAS SOMETHING TO 
    HIDE.

    anyone who refuses to show his code not only has something to hide,
    but has probably SOLD OUT to our invasive creeping slime 
    non-representative government.  

    Bill Clinton had the audacity to say at UConn something to the 
    effect:  "...censorship [loss of freedoms] is the first step on the 
    road to tyranny...."  $%&* HYPOCRITE!

    lawyers are lawyers, they make great emergency rations, and they
    taste like chicken, really.

 ______________________________________________________________________

  Lord grant me the serenity to accept the things I cannot change;
    The courage to change the things I can;
      The weapons that make the difference;
        And the wisdom to hide the bodies of the people 
          I had to kill because they were in the way.
 ______________________________________________________________________
 "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1
Comment: No safety this side of the grave. Never was; never will be

iQCVAwUBM4HMTr04kQrCC2kFAQEauAQAvKoCT4EunA3dyKOXFV9q2eDQEDCjvrgh
Qf9oMvyzhYAAe8mUl65DQW+rQfVEdjNBw5lBygeuoz7olVqPzLvN3RQgC4AhTfdy
z7iWX5aSDls75BLobKgc9BR/RBtNxEYP3+yupwHkd81hxwds1h9tA3Z220QBHAxm
SsA9B2i7g7o=
=JhTY
-----END PGP SIGNATURE-----

sameer wrote:
> 
> In a recent announcement, Netscape Communications announced plans to
> include government back doors in their products. "By implementing this
> so-called 'key recovery', Netscape is getting a small increase in key
> length in exchange for putting your keys in the hands of the
> government," said Parekh. "This the same government that hired Aldrich
> Ames, the same goverment that has IRS employees surfing taxpayer
> databases at will. What do you think is going to happen to your keys?"

This is utter crap, and I'm sure you know it.  All we're going to do is
provide an OPTIONAL (and I mean really optional, not the way the feds
use it) way for administrators to recover private keys.  This is not
GAK.  I will never work on a product that includes GAK.

Oh, but I guess saying that Netscape is responding to customer
requirements by including support for corporate key recovery wouldn't
make such good press release spam.

-- 
You should only break rules of style if you can    | Tom Weinstein
coherently explain what you gain by so doing.      | tomw@netscape.com