The following article has a quote from Bidzos claiming that they offered to review the code but that Netscape declined. Of course the good student is going to have them review it... How about having the Goldberg and Wagner review it for some bucks!!! 2 -- C -- ---------------------------------------------------------- Netscape's Internet Software Contains Flaw That Jeopardizes Security of Data By JARED SANDBERG Staff Reporter of The Wall Street Journal A serious security flaw has been found in Netscape Communications Corp.'s Internet software, jeopardizing sensitive financial data such as credit-card numbers that users pass over the global computer network. The company acknowledged the flaw and said it's issuing a software fix. But as is often the case with Internet security, it may take time for users to adopt the fix, leaving them vulnerable meanwhile. "It's a very big trapdoor," said Dietrich Kappe, a partner with Red Planet L.L.C., an Chicago Internet consulting firm. "You can drive a truck through it. Somebody goofed" at Netscape, he added. The breach presents a problem for Netscape, which produces the most popular software for browsing the World Wide Web, the multimedia portion of the Internet where businesses are setting up electronic storefronts to sell goods and services. Netscape has captured roughly 75% of the "browser" market, reaching roughly eight million people, who use the Netscape product to browse the Web and make credit-card purchases. The breach also underscores the persistent security problems that have plagued the Internet and forestalled electronic commerce. Netscape uses so-called symmetric key cryptography to scramble sensitive data so that they are unreadable by hackers snooping on the network. That key is essentially a mathematical formula so long that it makes it impractical for hackers to crack, even with powerful computers. The formula is generated by a random number that may be determined by the number of electronic-mail messages, for example. Netscape's software chooses a number between one and two-to-the-30th-power -- or roughly one billion. But on Sunday night, two graduate students at the University of California at Berkeley posted a message to the Internet's "Cypherpunks" mailing list, a group of mathematicians and programmers who discuss the science of cryptography. In the electronic missive, they said that the random number that generates the mathematical key was "fairly trivial to guess" and that the key "usually takes less than one minute to find." Rather than try to break the encryption "key," the two graduate students examined the so-called "random number generator" and discovered that the number isn't so random, allowing them to guess the encryption key. It took the two students, Ian Goldberg and David Wagner, two days to identify the vulnerability and write a software program that could guess the encryption key in less than one minute. Netscape's software, said Mr. Goldberg, 22 years old, "is not as good as people thought, which is probably worse than no security" since people have a false sense of security as they enter payment details. "The information we were using to create the key is now a known set of information," said Jeffrey Treuhaft, security product manager for Netscape. "We feel it's important to let our consumers know," he said, adding that the company will post a warning on its own Web site. "It's a serious hole, but it can easily be corrected," said James Bidzos, president of RSA Data Security Inc., which licenses security technology that Netscape incorporates in its system. Netscape said it plans to have a software fix to resolve the problem available for downloading over the Internet by the end of this week. RSA's Mr. Bidzos said his company offered to review Netscape's security when it first introduced its browser, but Netscape declined. "They're asking us to review it this time," he said. A month ago, a student at France's Ecole Polytechnique cracked the same weaker encryption system that U.S. government policy forces Netscape to use in a foreign version of its Navigator software. To break the code, the student used 120 computer workstations and two supercomputers working for eight days to break the so-called 40-bit encryption system, a number that refers to length of the encoding "key," which is used to scramble data. Netscape sells a far stronger version of its software that includes 128-bit key length, but is prevented by the government from distributing it on the Internet. The government fears that such strong encryption could fall into the hands of terrorists who might use it to communicate without fear of being tapped by U.S. security agencies. Security experts, however, noted that the same problem exists with the stronger software. ... __o .. -\<, Chris.Claborne@SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!