-----BEGIN PGP SIGNED MESSAGE----- I have no doubt that enterprising hackers will be able to hack the international version of lotus Notes to make it as secure as the domestic version. It is probably just a matter of NOPing some code. The real problem is the 64 bit key in the domestic version. This conforms to the NIST "standard" for an exportable system. In other words to allow the international people to have almost non-existant 40 bit security, they have limited domestic users to 64 bit secuity. The 64 bits keys must be breakable at least in some sense or the limitation would not be in the NIST "standard". The 64 bit keys are probably allocated in structures and stack allocations, so the hacking past the 64 bit limitation will probably be extremely difficult and error prone! (To increase the size of data in a structure or data on the stack means moving all the data beond it. This means increasing the memory allocated and changing all references to data beond the data whose size is increased.) To do this in a patch, may be difficult. In any case, I do not trust the code any large company if I do not have the source code. Big companies are too subject to presure. What we really need is a hack to completely substitute our own external code such as PGP! - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott@hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: cp850 iQCVAgUBMQbe8fBUQYbUhJh5AQHDoAQAg9eWu4aJrhQ87n+JqxfTjCOJKEKm8Bfr J9Gggh/jnzW1MY4ApjOtQes7sHR5+66i43E4nUnN0CJYyD+aMCjbJEhwLPU4uHy2 1nF36X0vCYe0+4uSrebW/eMpFBj6fFrVbrmF8tiGD2VrqSQ2Fda00PY9erKKD2KN GTmeqFL/QVY= =SDNt -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Paul Elliott writes:
The real problem is the 64 bit key in the domestic version. This conforms to the NIST "standard" for an exportable system. In other words to allow the international people to have almost non-existant 40 bit security, they have limited domestic users to 64 bit secuity.
The 64-bit domestic limit really has no connection to the 40-bit intl. limit. It would be just as easy to build the intl. version of Notes with 128-bit+spy keys, with 40 bits of truly protected key and 88 bits of espionage-enabled key, and then use straight 128 bits in the domestic version. They simply appear not to want people in the U.S. to have >64 bits of security, regardless of export issues. Futplex <futplex@pseudonym.com> Still drowning in mail.... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQhrTSnaAKQPVHDZAQGPIQf+J1HO2onogc8tbaFFobWtv1K68wFmYqfl 6vb4OUxHyxuaow2QwbFXiOY3gUQZ61yCRhTgc6IcZOzJG0pBEXBV5B/Hb3fVdWJX 0L31f5/rzYIMsR0cnnEhMI6QtjtZC6V4MDlTnVuDjW/CBbMyWizEj/73dJTS5OxH ekghkkvyObe6RbQTij/f3YVt+NYE94kiI/j9PXaq+n9mLJp4GID11EodD9Lwu3hD Z2dA8kPcSagh1uT0SdQcyB/mYML2VhiBY13alPci20+UXfgot+8hSG7c8yUtcKrW AmgtKI3/JLa5BwWcVC5XrvEX/L8xwzUB4FKCWUKhA5/+xiv8Kvxhdw== =VQIm -----END PGP SIGNATURE-----
participants (2)
-
futplexï¼ pseudonym.com -
Paul Elliott