[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Win2000 IKE and 3des



> Chun Ye wrote:
> 
> This is not a design error.

No, that is far too mild a term for it.

> If you have an export driver, how can you expect to run 3DES?

If I have a policy that says 3DES, how can you deliver DES?

At least one court:

http://www.thestandard.net/article/display/0,1151,1780,00.html 

has held a bank liable for using DES, described by the judge as
"out-of-date and not safe enough". If Microsoft software changes
the policy the system admin sets, who is liable for any damage?
  
> >>>>> "Sumi" == Sumi Singh <sumis@Exchange.Microsoft.com> writes:
> 
>  Sumi> Just to clarify the behaviour of Windows 2000 - Windows 2000
>  Sumi> weakens 3DES policy to DES if you do not have the strong
>  Sumi> encryption pack (128-bit) installed. This weakening is
>  Sumi> announced by an event in the Audit log. So if you have 2 peers
>  Sumi> with no encryption pack installed, and a policy to use 3DES,
>  Sumi> they will talk DES since they cannot do 3DES.
> 
> Clearly that's a major design error.
> 
> If you ask for something that's not supported, it should be rejected.
> To change it (even with a message in some obscure log) is clearly
> wrong.  You don't build secure systems that way.

Even with an audible alarm and a message in two inch red letters on
the console, it is clearly wrong.


Follow-Ups: References: