If somebody was forced to implement backdoors for the government, do you think they would be allowed to tell you?<br><br>
<div><span class="gmail_quote">On 5/14/06, <b class="gmail_sendername">Adam Shostack</b> <<a href="mailto:adam@homeport.org">adam@homeport.org</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Niels Ferguson says "over my dead body:"<br><a href="http://blogs.msdn.com/si_team/archive/2006/03/02/542590.aspx">
http://blogs.msdn.com/si_team/archive/2006/03/02/542590.aspx</a> He's<br>also said as much to me in person, as has Peter Biddle.<br><br>Adam<br><br><br>On Sun, May 14, 2006 at 10:43:22AM -0700, Ringo Kamens wrote:<br>| I'm not saying the AES is weak. I'm saying that Microsoft might have
<br>| implemented a back-door for governments. They could store the private keys and<br>| passwords in videocard memory or in the boot sector or something like that.<br>|<br>| On 5/14/06, Tony <<a href="mailto:Tony@tdrmail.co.uk">
Tony@tdrmail.co.uk</a>> wrote:<br>|<br>|<br>| 2. The restrictions on encryption were removed some years ago. The best<br>| encryption software comes from outside the USA anyway so it was always a<br>| pointless exercise in futility.
<br>|<br>|<br>|<br>| Unless a vulnerability is found in 256 bit AES it would take them longer<br>| than the ages of the universe to crack a key by brute force no matter how<br>| many terraflops of power they have to task on your key (not to mention the
<br>| many others they might want to crack)<br>|<br>|<br>|<br>| 3. Filtering content is not quite the same as signing code and pretending<br>| it comes from Microsoft. Such a piece of code would have a changed checksum
<br>| would likely be spotted and then analysed. I can't see Microsoft doing that<br>| unless required by law.<br>|<br>|<br>|<br>| 4. TPM is part of the trusted computing concept. It just makes it much<br>| harder. Not impossible.
<br>|<br>|<br>|<br>| ---------------------------------------------------------------------------<br>|<br>| From: <a href="mailto:owner-or-talk@freehaven.net">owner-or-talk@freehaven.net</a> [mailto:<a href="mailto:owner-or-talk@freehaven.net">
owner-or-talk@freehaven.net</a>] On<br>| Behalf Of Ringo Kamens<br>| Sent: 14 May 2006 18:31<br>|<br>|<br>| To: <a href="mailto:or-talk@freehaven.net">or-talk@freehaven.net</a><br>| Subject: Re: Some legal trouble with TOR in France
<br>|<br>|<br>|<br>| There are a few key points that you are overlooking.<br>|<br>|<br>|<br>| 1. In support of the photocopying money scandal, most printers have yellow<br>| dots imprinted on them that track date printed, serial number, etc.
<br>|<br>|<br>|<br>| 2. By US export law, US companies are not allowed to export encryption<br>| larger than 56 bit (although it might have jumped to 128 a few years ago),<br>| unless it has been certified by the government. That means unless it has a
<br>| backdoor. Plus, governments have thousands of teraflops of idle computer<br>| cycles waiting to crack your keys.<br>|<br>|<br>|<br>| 3. How can you honestly think Microsoft wouldn't bend over for the US<br>
| government. They bent over for China. Look at PGP. They moved to closed<br>| source after version 6.0 with no valid reason. The reason is probably the<br>| government.<br>|<br>|<br>|<br>| 4. In terms of using checksums to ensure your system hasn't been tampered
<br>| with, the computer hardware could have a defense system against that such<br>| as trusted computing.<br>|<br>|<br>|<br>| Ringo Kamens<br>|<br>|<br>|<br>| On 5/14/06, Mike Zanker < <a href="mailto:mike@zanker.org">
mike@zanker.org</a>> wrote:<br>|<br>| On 14/5/06 15:10, Tony wrote:<br>|<br>| > Nb- failure to disclose keys is up to two years in prison. Not 10.<br>| ><br>| > (5) A person guilty of an offence under this section shall be liable-
<br>| ><br>| > (a) on conviction on indictment, to imprisonment for a term not<br>| > exceeding two years or to a fine, or to both;<br>| > (b) on summary conviction, to imprisonment for a term not exceeding
<br>| > six months or to a fine not exceeding the statutory maximum, or to both.<br>|<br>| Furthermore, that's part III of RIPA which hasn't been enacted yet.<br>|<br>| Mike.<br>|<br>|<br>|<br>| This message has been scanned for viruses by MailController -
<br>| <a href="http://www.MailController.altohiway.com">www.MailController.altohiway.com</a><br>|<br>|<br>|<br>|<br></blockquote></div><br>