Subject: W2K fakes 128-bit crypto or not?

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 3 Jul 2000 01:40:04 +0200

Denis,
no news on this alarming news of yours?

Anders

-----Original Message-----
From: denis bider <[email-masked]>
To: 'Anders Rundgren' <[email-masked]>; [email-masked] <[email-masked]>
Date: Saturday, June 17, 2000 15:43
Subject: Off-topic: crypto crippling

>[I would have posted this to the sci.crypt newsgroup, but I dislike doing
>that for several reasons - among them, slow message propagation, spam and
>last but not the least, I do not have Usenet configured and it takes a while
>to find a server that carries sci.crypt. Does anyone know of a regular
>mailing list equivalent to the sci.crypt newsgroup?]
>
>Actually,
>
>I have heard a rumour that the '128-bit encryption' that Microsoft is
>shipping with Windows 2000 has actually been tweaked in such a way that it
>is only 128-bit when observed by a non-clued-in person, but is rather 40-bit
>for the people who know how it has been designed.
>
>In effect, rumour therefore has it that 88 bits out of the 128 are set in
>such a way that it is extremely easy to find them for someone who knows how.
>The French are supposed to have found this out, and they are supposed to
>have been a little bit upset because of this fact.
>
>I am not sure how much of this is actually the truth. The person I received
>this information from might have confused this with the silent "3DES -> DES"
>fallback in Windows that has been demonstrated lately.
>
>Can anyone confirm or deny the above rumour?
>
>Anyway. The bottom line is - I think people today are a little bit crazy to
>use, and even buy, security software as executables without any kind of
>access to the source code. It is plain stupid, and it gives the country
>which supplied you with the binaries a perfect weapon for the information
>wars that are due to ensue sooner or later. The world is not all roses all
>the time. Remember the several-billion-dollar deal which was lost by the
>European airplane manufacturer to Boeing because the USA was eavesdropping
>on their conversations with the purchaser?
>
>Iraq, Vatican and several others have learned this lesson when they bought
>black-box crypto machines from Crypto AG, only to find out that the machine
>transmits the encryption key almost in plaintext along with the encrypted
>message. Which, hence, was easily recoverable by folks from the NSA and from
>the German intelligence agency.
>
>denis
>
>
>-----Original Message-----
>From: Anders Rundgren [mailto:[email-masked]]
>Sent: 17. junij 2000 14:44
>To: PKIX-List
>Subject: Why is Java still crypto-crippled?
>
>
>I have since quite a while been using W2K (Bill, it IS great!)  using strong
>crypto
>although I live in Europe.   But why can't I get that for JDK?  Without
>special permissions.
>
>This is a *serious* threat to Java to be dependent on third-party tools when
>the "other guy" has it all built-in!
>
>Anders
>
>Not religious about Java but likes it anyway.
>
>

---

From: "denis bider" <[email-masked]>
Date: Mon, 3 Jul 2000 01:41:03 +0200

Hello Anders,

I have received no responses by members of this group.

I guess if the rumour had any merit then at least someone ought to have
heard? Or maybe not necessarily: just the other day I found sound-looking
information about how id Software has built a backdoor (yes, a back door,
kind of like Back Orifice) into its Quake product. Yes, Quake, the game.

It's interesting how these things don't get known or talked about - for
instance, the general population seems never to have heard about ECHELON.
Seems that, when it comes to striking news like this, people who haven't
seen the facts themselves are afraid of spreading the word, fearing that if
the rumour is proven wrong, they will be considered naive dummies without
credibility.

I have since subscribed to sci.crypt (hurray), so I'll run this W2K rumour
by them, too. I'll report if there is any response.

Regards,

denis

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: 3. julij 2000 01:40
To: [email-masked]; [email-masked]
Subject: W2K fakes 128-bit crypto or not?

Denis,

Anders

-----Original Message-----
From: denis bider <[email-masked]>
To: 'Anders Rundgren' <[email-masked]>; [email-masked]
<[email-masked]>