NSA's Backdoor Key from Lotus Notes

http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html

by EthanHeilman • 13 years ago

442 85 13 years ago

javanix• 13 years ago

Would they really put the NSA director's email in the PGP key? Something smells fishy about this.

pronoiac• 13 years ago

They didn't. To quote: "(of course I made this user id up -- you can edit it to whatever you choose it's of course not self-signed)"

s0rce• 13 years ago

quote from the article: "of course I made this user id up"

rattray2• 13 years ago

Why is this comment being downvoted? It was an honest, albeit rather silly mistake, not a misuse of HN.

Pitarou• 13 years ago

It's an irrelevant remark from somebody who didn't read the article properly.

Downvoting:

- reduces the prominence of low quality content

- encourages posters to avoid posting low quality content

anonymfus• 13 years ago

This page has also been translated into Russian here

It is not in Russian. It's in Belarussian.

mietek• 13 years ago

and into Polish here

This is, at best, an odd machine translation.

fdb• 13 years ago

The translation is a sneaky SEO technique. People offer to translate your page into other languages as long as you link to the translation on their page. By linking to them, you pass on PageRank. The website has of course nothing to do with your content.

jamesaguilar• 13 years ago

I may be willing to believe the NSA are misguided, but nobody uses the bad guys' name for themselves on purpose. The NSA used Minitruth as the name of their backdoor? Gimme a break.

EthanHeilman3• 13 years ago

This isn't a rumor or some strange conspiracy this is just how crypto-export controls were done for a short while in the US.

http://www.heise.de/tp/artikel/2/2898/1.html

http://catless.ncl.ac.uk/Risks/19.52.html#subj1

but nobody uses the bad guys' name for themselves on purpose.

Why not, I've heard of software teams naming themselves Cobra from GI Joe.

ianterrell• 13 years ago

I'd rather not be spied on at all, but if someone's reading my emails I sure hope they have a sense of humor.

thesagan• 13 years ago

I don't know, The darker side of me gets a kick out of it, really. It's interesting language to say the least.

gcb02• 13 years ago

This is a joke on the implementation. I bet only the lotus devs ever read those names before.

cbs• 13 years ago

I assumed it was the work of the programmer tasked with installing the key for the NSA, not some self-deprecating humor.

Havoc• 13 years ago

The NSA used Minitruth as the name of their backdoor? Gimme a break.

More like the guy charged with implementing it had a sense of hunour / clear perspective.

stan_rogers2• 13 years ago

The folks at the Iris group were very much like that. Around the same period, the project that would become Lotus Quickplace and the iNotes web client was codenamed "Shimmer", after an old Saturday Night Live fake ad for a do-everything product that was both "a floor wax and a dessert topping".

pa7ch• 13 years ago

You must not be familiar with 'palantir'. A seeing stone used for spying, communication, and manipulation by Sauron and Saruman in LOTR.

acqq2• 13 years ago

Also from these times:

http://en.wikipedia.org/wiki/NSAKEY

An example of coverage, very similar to what we read now:

http://www.whale.to/b/ms.html

mpyne4• 13 years ago

The NSAKEY entry was actually recently posted here...

pyre3• 13 years ago

Read Schneier's take on it: http://www.schneier.com/crypto-gram-9909.html#NSAKeyinMicros...

It seems reasonable that NSAKEY wasn't an NSA backdoor meant allow them to secretly install compromised crypto libraries on your machine.

acqq2• 13 years ago

It was obviously made for NSA. Otherwise the name wouldn't mention NSA. Microsoft didn't need the backup key, they were able to back up the single Microsoft key. Nobody designs the crypto with two keys accidentally. How NSA used it we can only speculate, but it was there on purpose, the truthful wording of Microsoft was "it was there for us to obey the law."

apapli• 13 years ago

Given many companies running notes push forms out to their web site, I am curious, does now knowing this key increase the vulnerability of Lotus Notes servers everywhere as theoretically anyone can use it now?

gcb02• 13 years ago

Nope. Those are called public for a reason.

And if you are working with online business, as i guess for you being here, i highly recommend you read at least some introduction on PGP.

stan_rogers2• 13 years ago

That applies to versions of Notes and Domino prior to R5.0.4, since which there has only been one version (outside of France, at least, which didn't authorise import until October 2000 -- that's due to France's crypto import regulations at the time, not the USA's crypto export regs). This back door ceased to exist more than a dozen years ago, and the current international key length is more than 64 bits (4096 bits for users/servers, 8192 bits for certifier ids).

krenoten2• 13 years ago

Interesting article, but slight quibble: differential cryptography is a cryptanalysis technique, ie a method that anybody can use to try to break a cipher.

http://en.wikipedia.org/wiki/Differential_cryptanalysis

EthanHeilman3• 13 years ago

This is differential work factor cryptography rather than differential cryptanalysis. Differential work factor cryptography is design crypto systems are easier for one party to attack.

http://www.purecommerce.com/dictionary/ecommerce/differentia...

krenoten2• 13 years ago

Ahh interesting, I wasn't aware of this use of the term. Thank you for the clarification!

cocopanda• 13 years ago

Should I be worried about looking at this.

YeahWhateverMan• 13 years ago

Yeah, but who fucking cares anymore.

Like, based on the events of the past week, I think we can all agree that whatever you're paranoid about right now, they've already far exceeded and overstepped your pedestrian low-ball estimates for what might be excessive, and in reality it already happened a decade ago, so you're just worrying about spilled milk.

mpyne4• 13 years ago

Far more than a decade ago.

I mean Jesus, you kids act like the government has been slowly and monotonically eroding privacy rights since 1789. :)

Go read about the Church Committee

Go read about HUAC.

Go read about when we locked up the Nisei.

And I'm not saying any of this to justify anything that's happening today. What I am saying is that IT'S BEEN MUCH WORSE BEFORE, and we STILL FIXED IT ANYWAYS.

This isn't a ratchet-and-pawl fixture. Don't like something in the government? Go fix it! But stop acting like it's already been set in stone, or that everyone in government is the enemy of the people advancing some Illuminati conspiracy. By and large they're trying to do the right thing for the nation, who have interests far beyond what Greenwald or Michael Moore or Glenn Beck or Rush Limbaugh feels is important on any given day.

nwh• 13 years ago

Nope. It's a public key, which by design, is able to be shown publicly.

jlgreco2• 13 years ago

It is a public key, but it is small by todays standards. You could factor it with a modest budget.

jrockway3• 13 years ago

If I were a programmer that wanted to damage the reputation of my employer, I'd embed a key in its software that made it look like the software was sending all user data to the NSA. Any denial would meet "well, there's a secret law making you deny it". The perfect crime...

acjohnson55• 13 years ago

Somehow, I don't think the NSA would look kindly on that, and who knows how that might affect you. Not exactly the perfect crime.

jrockway3• 13 years ago

What consequences do you envision?

rozzie• 13 years ago

Ray Ozzie here. Regarding "minitruth" - you've got to maintain a bit of a sense of humor when things get stressful.

It was such a long time ago, but one thing that clearly differentiates our efforts in those days vs. what's been reported in the news in the past few days is the issue of transparency.

The day we shipped the "differential workfactor" implementation in Notes, I keynoted the RSA Conference and gave a speech laying out what we did and why. Charlie Kaufman, a great cryptographer who worked for me, also distributed a paper he wrote with the technical details. You can find my speech and his paper buried in here if you're interested. (search for "lotus.notes")

http://web.textfiles.com/ezines/HWA/hwa-hn19.txt

And if you're really motivated to understand what it was like during the Crypto Wars, go read Steven Levy's book "Crypto".

http://www.stevenlevy.com/index.php/books/crypto

Back to the present - it pains me to see such a lack of transparency in how our elected officials are running our government. Of course, the common man knows it's common sense that there's an inherent need for secrecy in conducting small scale covert operations. We do get it.

However, it's also common sense that it's inevitable that any complex large-scale long-term operation will ultimately come to light. And so it's just common sense that any such broad-based operations that might be perceived as impacting our constitutional rights should be the subject of broad public debate. No, not when they're being prototyped or tested or used in small scale settings - but definitely somewhere on the path from "tactical use" to "broad strategic dependence".

These are not small issues, nor need they be at all partisan. Wyden, Paul, and others are trying. Theses issues are fundamental to defining the relationship between us citizens and our government in the decades ahead.

In particular, in this world where "SaaS" and "software eats everything" and "cloud computing" and "big data" are inevitable and already pervasive, it pains me to see how 3rd Party Doctrine may now already be being leveraged to effectively gut the intent of U.S. citizens' Fourth Amendment rights. Don't we need a common-sense refresh to the wording of our laws and potentially our constitution as it pertains to how we now rely upon 3rd parties? It makes zero sense in a "services age" where granting third parties limited rights to our private information is so basic and fundamental to how we think, work, conduct and enjoy life.

For example, did you really intend to yield your 4th amendment rights when you granted a 3rd party access to your files as a part of Mac Software Update, Windows Update, Virus Scanners, etc., or when you started using a service-tethered smartphone?

Anyway, unlike 'web tracking' issues which seem to be broadly ignored because of our love for ad-supported services, I hope we all (especially the young readers of reddit, hackernews, etc) wake up to the fact that these privacy and transparency issues are REAL, and that they truly will impact you and the country you live in, and that even if you don't consider yourself an activist you really should get informed and form an opinion. Again, this is a non-partisan issue, and let's all work to ensure that it stays this way.

Two great organizations where you can learn are EPIC and EFF. (Disclosure: I am on the board of EPIC.) Take it in, and think. Your contributions are needed and would of course be quite welcome.

http://epic.org

http://eff.org

philangist• 13 years ago

I'm a coder and one of the young redditors/HN readers you're talking about (18 years old). I've grown up in a post-9/11 world so it can be sometimes hard for me to understand that there was a time that it wasn't assumed the government wasn't conducting mass surveillance. How do you approach the problem of making this a real issue for most people my age? And as technologists, how can we help develop solutions to intrusive government policies like this?

angersock2• 13 years ago

The big deal is that honestly young people seem not to think twice about yielding up their personal information to the data maws (older, non-tech folks have the same issue, so let's not spin it as a purely generational problem!).

If you need to make it a "real issue", well, honestly, you lack a sufficiently cruel and malicious imagination--it should be self-evident that any sort of monitoring and data-mining (.gov or not) is very dangerous, and something which you should think very carefully about opting into.

We need to make this an issue for everyone, not merely millenials. Unfortunately, that doesn't seem like it's going to happen until there are more casualties in the privacy wars.

endgame2• 13 years ago

People who grew up under relatively benign surveillance may not have the imagination or experience to see what happens when all that data is used maliciously. So you need to get people reading. Historical accounts. Recent experiences[1]. Fiction[2].

[1] http://www.reddit.com/r/changemyview/comments/1fv4r6/i_belie... [2]: http://www.randomhouse.com.au/books/claire-carmichael/incogn...

btilly• 13 years ago

Let me make it crazy for you. I remember a day when you didn't need ID to fly on an airplane, or a security badge to get into normal office buildings. And when the idea of having to insist on such was considered unamerican and a sign of a totalitarian state.

NamTaf• 13 years ago

I'm 27. One of the few memories from my childhood that I cling most dearly to was when in 1994 I flew to the US from Austraila. The pilots invited my family and I up to the cockpit during the flight so I could see the controls of a 747.

This wasn't some uncommon special event either. It was part and parcel of doing an international flight as a kid.

yitchelle• 13 years ago

I am in my early 40s, grew up in SEAsia and Australia. Although I enjoy relatively lack of surveillance in those area, I lived in a time where the cold war was occurring between East and West and just after the infamous FBI [1] surveillances. So surveillance has always been there.

I truly believe that our population were always under surveillance (either covertly or overtly), it just that in todays' technological landscape, the folks doing the surveying are easier to be caught out.

[1] http://en.wikipedia.org/wiki/COINTELPRO

ctide• 13 years ago

I'm sad that this comment was posted on a weekend, because I think this is one of the awesomest things I've seen on HN, and not a lot of people are reading HN on Saturday nights and they're going to miss it.

sysm• 13 years ago

agreed

JeremyMorgan• 13 years ago

naw, something this big will still be big on Monday

md224• 13 years ago

However, it's also common sense that it's inevitable that any complex large-scale long-term operation will ultimately come to light.

Is it, though? Is it unlikely that some projects that a government undertakes could remain hidden indefinitely, or at least until after the collapse of said government?

mpyne4• 13 years ago

If anything, it's even easier to leak the existence of evil government projects (in the U.S. at least) than in practically any time in the past. The U.S. even provides the majority of the funding to Tor that could help you do it too.

Back in the day you had to somehow take pictures of documents you wanted copied, do it in a way that didn't draw suspicion, you were limited to what you could physically examine (and carry), and pretty much everything was huge compared to miniturized technology of today.

And after all, think back to who provided the intel to Greenwald and the WaPo again? The vast majority of government employees, even in agencies like NSA and FBI, feel that they are acting in the public interest (or at least, not against the public interest).

It's not as if there's a University of Illuminati and Zionists for the government to hire conspirators out of.

So I think Ray Ozzie is right on point, with that part among his other points.

benjamincburns5• 13 years ago

First, thanks for recommending Steven Levy's Crypto. It's a historical account that I think more hackers need to read.

I'm probably on the hairy edge of the "young readers" you've mentioned. I'm 27. My present view on the recent NSA leaks is a distinct lack of outrage, but watching this huge response I can't help but feel the whoosh as something big flies straight over my head.

I've agreed to use technology which by its very nature monitors my activity in all kinds of ways. As a software engineer who does a lot of web work and dabbles in cell-enabled embedded systems, I understand and I'm fully aware of most of the ways I'm being monitored. Maybe I'm naïve to think of the recent data sharing between corporations and government as a non-issue, but if this is such a big deal wasn't I just as naïve by allowing these corporations to collect this information in the first place?

This isn't the Clipper Chip or key escrow. This isn't the government grappling for an ear into conversations which nobody except Alice and Bob are intended to transceive. You could argue that were I Bob, Alice is the phone company, but I have no freaking clue who "the phone company" really is. To me it's just a faceless entity who I've allowed to collect data about me. I'm finding it hard to become angry over one faceless entity sharing said data with another faceless entity. And frankly, I have no clue if I've already agreed for this to happen because I don't really care. I expect them to share a ridiculous amount of information about me without abandon. I'd be far more upset if they were sharing content of actual conversations, but metadata feels firmly within the realm of what I expect to be slung around willy-nilly.

I agree that this reasoning is wholly a "death by a thousand cuts" brought on by more and more invasive technologies. As an anecdote, many Facebook early adopters will remember the outrage over the news feed when it was first launched. Now can you imagine the outrage that would ensue if Facebook were to take it away? We're pretty much begging for invasive technology in our lives. How do you propose to correct that? How do we get millions of people to "vote with their feet" against useful-but-invasive technologies?

wavesounds2• 13 years ago

If you're apathetic its because you don't know your history. For example, our government not that long ago locked up every Japanese-American they could find in prison camps. The government is entirely capable of doing terrible things. We should by principal only give them as much power/money/information as necessary and not an iota more. Being cynical and apathetic is a danger to you and your fellow Americans.

barrkel• 13 years ago

It took thousands of years of human civilisation before we got relatively benign governments. Power structures are not inherently benign; they must constantly be pressured to prevent malignant people using them to leverage their actions.

A non-authoritarian government is an historical anomaly. It's a ball balanced on top of a hill, pushed there by the deaths of millions, and kept there by the vigilance of those who care.

Please start caring.

kunai• 13 years ago

What is more frightening than the leaks themselves is the future of this administration and the administrations to comes, assuming that they will continue in a partisan manner. It's only a downward spiral from here.

What needs to be effected is not the abolishing of government agencies. What needs to be effected is an administration that is clear and transparent with its actions, not necessarily the implementation of said actions.

And yes, education is a must. The EFF and EPIC are both organizations working to change the apathy perpetuated by the mass media.

TheYComb• 13 years ago

http://support.citrix.com/article/CTX116557

Getting the private key is as easy as having a smart person inside the company that works for both the company and the gov.

Then you just have to sit on a router and read the traffic. Relatively simple for a gov agency.

There are 2 ways to be safe: 1) You do not use any technology. 2) You are honest in everything you do.

The second one is probably the easiest.

scaramanga• 13 years ago

hmm, I was expecting to see that they'd factored the private key. It's been done before for 768bits RSA and presumably both NSA and RSA are picking good semiprimes but maybe not eh? That would be interesting to know.

BruceLi• 13 years ago

Welcome to China!

NSA's Backdoor Key from Lotus Notes

Related Stories