Lotus to export 64 bit, partially-escrowed Notes
Alerted by a colleague at the RSA Data Security conference today, I just checked the Lotus site. Folks may wish to look at http://www.lotus.com/home/whatsnew.htm A new 'international' version of Lotus notes is being released, with 64 bit session keys, as opposed to the old 40 bit version. 24 bits of the session key are stored encrypted under a special, government-access RSA public key. This is in addittion to the full 64 bit key being available under the recipient's public RSA key. The idea is that the USG would have to search only a 40-bit keyspace, while others will need to search a 64-bit keyspace. Reportedly, this 'workfactor reduction key' will NOT be available to foreign governments. My colleague reports that opinion at the conference was divided over whether Lotus was doing something which made good business sense, or whether this was 'caving-in'. Speaking only for myself Peter Trei trei@process.com
Note that it is slightly easier to break this encryption than the 128 bit encryption with 68 bits sent in the clear used by Netscape. I think in general that any steps taken to reduce the amount of information avaliable. I'm happier if only the US government has access to the extra 28 bits of privacy than if everyone does. That is not to say that I am happy. This is better than the government proposal for GAK which would have very easy access to the message content. 40 bits of privacy means that they do at least need to do some work. I would prefer it to be 48 at the very least. Phill
Note that it is slightly easier to break this encryption than the 128 bit encryption with 68 bits sent in the clear used by Netscape.
I think in general that any steps taken to reduce the amount of information avaliable. I'm happier if only the US government has access to the extra 28 bits of privacy than if everyone does. That is not to say that I am happy.
Of course, if someone patches the program to incorrectly encrypt the 28 bits for the government, it will be transparent until some nasty TLA tries decrypting the key. This was the same problem that existed with the Clipper LEAF, if I recall correctly, in that systems with hacked LEAF fields interoperated perfectly with unmodified ones. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd@netcom.com $ via Finger. $
participants (3)
-
hallam＠w3.org -
mpd＠netcom.com -
Peter Trei