William H. Geiger III writes:
In <L0c53D131w165w@bwalk.dm.com>, on 03/05/97 at 07:44 PM, dlv@bwalk.dm.com (Dr.Dimitri Vulis KOTM) said:
"Bob Atkinson (Exchange)" <bobatk@EXCHANGE.MICROSOFT.com> writes:
Actually, and sort of to the point, no, the keys never actually ever the BBN box, except as part of a backup procedure in which they are extracted in a doubly-encrypted form for which for security reasons you need the manufacturer's help in restoring.
To this day, no human or computer other than the box itself knows the
But do we necessarily believe what Microsoft people say?
If Bill Gates got on national TV and told the world that the sky was blue I'd have go outside and look for myself.
Actually, around Redmond, gray skies are much more common. Really guys, If you want to attack Authenticode (and I personally consider it a bandaid on a dangerous system), then stealing or buying the key is not the approach to take. I see two possible approaches to prove it's weakness. 1. If they are using RSA, factor the public key. This depends on it's length. Considering the amount of cpu people seem to be able to muster for distributed cracks, etc, I suspect that 512 bit keys will soon be vulnerable (equiv = RSA 155). 2. Write a Trojan Horse ActiveX control which disables the Authenticode checking, then covers it's tracks. No, I'm not working on either of these. Peter Trei trei@process.com Disclaimer: I speak for myself, not my employer.