-----BEGIN PGP SIGNED MESSAGE----- - -- [ From: Alan Pugh * EMC.Ver #2.3 ] -- Since this is definitely on-list, and I haven't seen anything on it here yet, I'm posting the whole thing. Apologies for duplication. Date: Wednesday, 17-Jan-96 04:23 PM Subject: infoMCI FLASH - Lotus-Security - Lotus Announces C [infoMCI FLASH] i n f o M C I F L A S H infoMCI (sm) Lotus-Security - Lotus Announces Compromise for Export of Strong Encryption By ELIZABETH WEISE AP Cyberspace Writer SAN FRANCISCO (AP) _ Lotus Development Corp. announced a compromise with the federal government Wednesday that will allow it to put better security features into the international version of its Notes program. While the arrangement assures the government it can access data under extreme circumstances, it represents an advance in the strength of security allowed in software exported from the United States. Federal law prohibits the export of certain high-level encryption programs, which are defined as a munition under a Cold War-era arms control act. Encryption programs take ordinary data and put it in secret form that cannot be accessed without the proper data ``key.'' The government's arbitrary standard for cracking encryption programs when needed is at a technical level described as ``40-bit.'' Some software programs sold in the United States, including Lotus Notes, now use stronger 64-bit encryption. Lotus has been under pressure to bring such security to Notes users overseas. Although 40-bit encryption is quite strong, highly-sophisticated attacks using several computers have been able to break it recently. ``Our customers have basically lost confidence in 40-bit cryptography,'' said Ray Ozzie, president of Iris Associates, the unit of Lotus that developed Notes. ``That left us in a bind. We are the vendor that's supposedly selling a secure system to them and they are saying it's no good,'' Ozzie told a standing room audience at the RSA Data Security conference. Changes in the general export laws seemed unlikely so Lotus negotiated an interim solution. The export version of Lotus Notes 4.0, which went on sale last week, includes 64-bit encryption but the company has given the U.S. government a special code that unlocks the final 24 bits. For companies that use the international version of Notes, it's as if Lotus put two strong locks on a door and gave a key for one to the U.S. government. Thieves have to get break through two locks, the government only one. ``This protects corporate information from malicious crackers but permits the government to retain their current access,'' Ozzie said. He acknowledged the solution was only a compromise and said Lotus wants to see better data security methods developed worldwide. However, many participants at the conference saw the move as a cosmetic answer to the tension between corporate desires for the best security and government's interest to access data when necessary. ``It's a useful stopgap measure that has no value in the long run,'' said Donn Parker, a senior security consultant with SRI International, a computer research company in Menlo Park, Calif. Simson Garfinkel, author and computer security expert, said he's not sure international buyers of Notes will like the solution. ``Foreign companies don't want the U.S. government to spy on their data any more than the U.S. government wants foreign companies to be able to spy on theirs,'' Garfinkel said. International Business Machines Corp. bought Lotus in July, citing the success of Notes, a sophisticated communications and database program. AP-DS-01-17-96 1619EST (66413) *** End of story *** - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMP2KdioZzwIn1bdtAQGdegF9GVCEfL50vWd7e5XX/mKEnzGy5YGvW0iD rNPCmz3Xxf3h9wOVJMLrCeDGwe4/m84g =6jpa -----END PGP SIGNATURE-----