At 10:43 AM -0500 5/24/2000, Rick Smith wrote:
>At 03:48 PM 05/23/2000 -0700, John Gilmore wrote:
>>Rick Smith wrote:
>>> If the NSA approaches Microsoft to acquire their support of NSA's
>>> surveillance mission, then the information will have to be shared
>>> with a bunch of people inside Microsoft, and they're not all going
>>> to keep it secret.
>>
>>Two people in Microsoft would need to know. Bill Gates, and the lead
>>programmer on the part of the product ...
>
>I'm not sure anyone, not even the richest man in the world, can make
>software do something tricky just by ordering a single person to do it.
>It's never worked that way in my own experiences with software development.
>
>If Bill wants to do something simple (and somewhat detectable) he can send
>his minion after the RNG, or better, order the RNG maintainer to break it.
>If their security group isn't particularly sophisticated (i.e. if
>experienced people like Lipner have been reduced to PR mouthpieces) then
>such a hack would succeed with minimal exposure. But outsiders can detect
>the hole by analyzing RNG output.
Done properly, there is no way anyone is going to detect a weakened
RNG by analyzing its output. That is why RNG attacks are so
attractive.
>If Bill goes for a more complicated and functional backdoor, like "Joshua"
>from "WarGames," or Thompson's invisible login hack, then there'll be a lot
>more people involved. They'll want something that doesn't spring open when
>Matthew Broderick makes a few guesses (maybe it requires Sandra Bullock
>with the magic diskette). That'll require a design that affects several
>different components in the system, which in turn requires buy-in from
>other developers.
The best answer to this comment is a report Lucky Green gave to this
list on 9/3/1999 when the _NSAKEY story broke:
"After watching the NSAKEY talk at the Crypto rump session [name elided], by
his own account at the time the person ultimately responsible for CAPI at
Microsoft, told a group that even he had not know about the second key. In
addition, he informed us that access to the Windows source code is heavily
compartmentalized, making it easy to insert modifications without the
knowledge of even the respective product managers."
Rick Smith continues:
...
>Secrecy isn't too hard if you have a one time event you need to protect. I
>believe it's easy to put in a temporary back-door or Trojan to, say, crash
>the Iraqi air defense system at the beginning of a major attack. But it
>gets incredibly hard to keep such mechanisms secret as time goes on. Loose
>ends keep slipping out and making the secret more visible, like torn
>threads around a hole in your shirt.
I certainly agree that keeping a long-term secret is harder than
keeping a short term secret. But NSA and Microsoft may well be up to
the task. One approach might be for Microsoft to hire a few
programmers who are also on the NSA payroll and place them in
strategic positions. NSA seems to know how to motivate folks to keep
their mouths shut. And the _NSAKEY episode demonstrates that a slip
up would not be not as damaging to either party's reputation as you
seem to suppose.
It seems to me that the burden of proof is on Microsoft to convince
us that their products are uncompromised. I frankly do not see how
they can do this short of publishing their source code. Even if they
do, the code base is probably far to massive to review. It may be
time to give up on commercial operating systems and start thinking
about what an open secure computing environment should look like.
Arnold Reinhold
