What are the implications of the NSA key in CryptoAPI on PGP Security?
CryptoAPI is present in all modern version of Windows, including NTv4, Windows 2000, Windows 95 & Windows 98 and offers cryptographic primitives for use in high level applications (such as the SSL implementation in Internet Explorer and the S/MIME implementation in Outlook). Recently it has been disclosed that CryptoAPI (Microsoft’s Cryptographic API) has a “secret” key that enables the holder of the key to sign CryptoAPI modules (these modules are known as CSPs, or Cryptographic Service Providers) – these modules can then be silently installed onto a users machine. The real big news is that this key is call _NSAKEY internally by windows. This has led to speculation that this key is really a NSA owned key that allows them to remotely install weakened crypto onto users machines etc. The _NSAKEY variable name was only discovered by accident – MS forgot to strip the symbolic debugging information from NT v4 SP5 which allowed A.Fernandes of Cryptonym to detect the name of the variable and
