From: Information Security <guy@panix.com>
Date: Tue, 6 Oct 1998 11:25:29 +0800
To: cypherpunks@cyberpass.net
Subject: Re: Web TV with 128b exported
Message-ID: <199810070119.VAA23135@panix7.panix.com>
MIME-Version: 1.0
Content-Type: text/plain



   >   From: SDN <sdn@divcom.slimy.com>
   >   William H. Geiger III wrote:
   >   > David Honig said:

   >   > >http://biz.yahoo.com/prnews/981005/ca_microso_1.html
   >   > 
   >   > >MOUNTAIN VIEW, Calif., Oct. 5 /PRNewswire/ -- Microsoft Corp.'s (Nasdaq:
   >   > >MSFT - news) WebTV Networks today announced it is the first U.S. company
   >   > >to obtain government approval to export nonkey recovery-based
   >   > >128-bit-strength encryption for general commercial use. WebTV Networks
   >   > >pioneered low-cost access to the Internet, e-mail, financial services and
   >   > >electronic shopping through a television set and a standard phone line. 
   >   > 
   >   > I have my doubts on this. I find it highly unlikely that the FEDs would
   >   > approve this without some form of GAK built in even if it is not in the
   >   > form of "key recovery".
   >
   >   It's probably a lot closer to the "private doorbell" scenario.  The only
   >   thing that a WebTV unit will communicate with is the WebTV service (or
   >   the Japanese variant thereof).
   >
   >   Since all traffic goes through a point that will likely cooperate with
   >   law enforcement (and has remote control of the boxes, too.), this doesn't
   >   represent much of a loosening in the export controls.

Hmmm...

#   http://biz.yahoo.com/prnews/981005/ca_microso_1.html
#   
#   ...without fear of interception by unauthorized parties.

Said with a lawyer's precision.

#   http://biz.yahoo.com/prnews/981005/ca_microso_1.html
#   
#   William Reinsch, U.S.  undersecretary for export administration:
#   ``The WebTV Network provides secure communications for its
#   customers and partners without posing undue risks to
#   national security and law enforcement.'' 

Either it is interceptable and decodable or it isn't.

If it isn't, then software browsers (Netscape/IE) should
be allowed to do it too.

Perhaps Declan could investigate and get a story out of it.

----

Can someone with control of a 128-bit HTTP server see if
it can identify 128-bit keys from WebTV terminals?
---guy