From: Ray Arachelian <sunder@brainlink.com>
Date: Tue, 30 Dec 1997 03:27:03 +0800
To: "J.A. Terranson" <sysadmin@mfn.org>
Subject: RE: [NTSEC] SKIPJACK / NT4.0 (SP3?) (fwd)
In-Reply-To: <01BD123E.5965AD70@pdc.mfn.org>
Message-ID: <Pine.SUN.3.96.971229101829.4823B-100000@beast.brainlink.com>
MIME-Version: 1.0
Content-Type: text/plain




Actually, a quick browse through several machines' registry revealed this
key as well in a list of cyphers. 

The bitch lives in:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Skipjack

Along with shit like the following under Ciphers.

Des40/56
Des56/56
Null
RC2 128/128
RC2 128/40
RC4 128/128
RC4 40/128
RC4 64/128
Skipjack
Tripple DES 168/168

Interestingly all the DES and RC2/RC4's have the same value (0xffffffff)
for the enable key (including TrippleDES).  Skipjack, and RC4 64/128 have
different values (0x30, and 0x3f respectively).  Null has an enable value
of zero. 

Adjacent to the ciphers key, there is a key for hashes listing MD5 and
SHA, next to that is a KeyEXchangealgorithms key listing:
Diffie-Hellman, PKCS, and Fortezza.  All of these except Fortezza use
0xffffffff as the enable value.

The Fortezza and Skipjack keys have the same "Enabled" key values! 
Additionally there is a ServerHandshakeTimeout value on the Fortezza key
of 60000. 

Likely this "enabled" value is a link to some DLL that contains their
code.

There is also a key called Protocols listing: "Multi-Protocol
Unified Hello", PCT 1.0, SSL 2.0, SSL 3.0, TLS 1.0.  All of these have
subkeys of "Client" and "Server" with no values set.

Adjacent to this key, is a key called Certification Authorities, showing
shit like AT&T, GTE, MCI, Keywitness Canada, Thwate, and of course
Verisign.


I've sniffed around schannel.dll and it is what builds or looks for these
registry entries.  It also looks for rsabase.dll and crypto32.dll and
cryptodlg.dll(?).  In schannel.dll there's a string that says: Fortezza
(DSS/SHA).  So SHA is there.

IMHO, From the looks of it, these are just stubbs without any code behind
them since the RSA code contains the RC2/RC4, RSA, etc. code.  (Though I
could be wrong.)


It's not SP3.  I've got two servers with SP3 and IIS3.0with ASP and no
Skipjack keys, so that leaves IE4 or IE3 as possible suspects (or some of
the hotfixes.)  The non-Skipjack entry machines do have all the other
cyphers, so something in ie4 and/or iis4 is what adds them in.
Interestingly enough this entire subkey isn't in Nt5Beta1. :)


> to a Skipjack (ie. fortezza) site.  I doubt you have the code as it is
> classified and available (at this time) only in hardware.  Don't sweat it,
> it looks like it's just a hook or .....

Yep.

Likely what it could be is a hook to a device driver that talks to a PC
Fortezza card or some such.
 
=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|  Ray Arachelian    |Prying open my 3rd eye.  So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were      |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run  |\/|\/
../|\..| "A toast to Odin,  |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were....            |.....
======================= http://www.sundernet.com ==========================