View source for NSAKEY

{{short description|Variable containing a public key in Windows NT 4.0}}
{{DISPLAYTITLE:_NSAKEY}}
'''_NSAKEY''' was a [[variable (computer science)|variable]] name discovered in [[Windows NT 4.0|Windows NT 4 SP5]] in 1999 by Andrew D. Fernandes of Cryptonym Corporation. The variable contained a 1024-bit public key; public keys are used in [[public-key cryptography]] for [[encryption]] and [[Digital_signature|digital signature verification]] (but not decryption or signing). Because of the name, however, it was speculated that the key would allow the United States [[National Security Agency]] (NSA) to subvert any Windows user's security. Microsoft denied the speculation and said that the key's name came from the fact that NSA was the technical review authority for [[Export of cryptography from the United States|U.S. cryptography export controls]].

== Overview ==

[[Microsoft]] requires all [[Cryptographic Service Provider]]s used by the [[Microsoft CryptoAPI|Microsoft Cryptographic API (CryptoAPI)]] to have an RSA [[digital signature]]. Since only Microsoft-approved providers can be used with the CryptoAPI, it is possible to keep export copies of this operating system in compliance with the [[Export Administration Regulations]] (EAR), which are enforced by the [[Bureau of Industry and Security]] (BIS).<ref name=Chappell>{{cite web|url=http://members.ozemail.com.au/~geoffch@ozemail.com.au/security/cryptoapi/cspsigs.htm|first=Geoff|last=Chappell|title=CSP Signatures|date=September 12, 1999|archive-url=https://web.archive.org/web/20060504051529/http://members.ozemail.com.au/~geoffch@ozemail.com.au/security/cryptoapi/cspsigs.htm |archive-date=4 May 2006 }}</ref>

It was already known that Microsoft used two keys, a primary and a spare, either of which can create valid signatures. Upon releasing the Service Pack 5 for [[Windows NT 4.0]], Microsoft had neglected to remove the [[debugging symbol]]s in ADVAPI32.DLL, a library that exposes such Windows features  as [[Windows Registry]] and security. Andrew Fernandes, chief scientist with Cryptonym, found the primary key stored in the variable {{tt|_KEY}} and the second key was labeled {{tt|_NSAKEY}}.<ref name="Cryptonym">{{cite web|title=Microsoft, the NSA, and You|url=http://www.cryptonym.com/hottopics/msft-nsa/msft-nsa.html|last=Fernandes|first=Andrew|date=1999-08-31|website=cryptonym.com|publisher=Cryptonym|url-status=dead|archive-url=https://web.archive.org/web/20000617094917/http://www.cryptonym.com/hottopics/msft-nsa/msft-nsa.html|archive-date=17 June 2000|access-date=26 October 2005}}</ref>  Fernandes published his discovery, touching off a flurry of speculation and [[conspiracy theory|conspiracy theories]], including the possibility that the second key enabled the United States [[National Security Agency]] (NSA) to subvert any Windows user's security.<ref name="CNN">{{cite web|title=NSA key to Windows: an open question|url=http://edition.cnn.com/TECH/computing/9909/03/windows.nsa.02/|date=5 September 1999|website=CNN Online|publisher=Cable News Network|url-status=dead|archive-url=https://web.archive.org/web/20151005212459/http://www.cnn.com/TECH/computing/9909/03/windows.nsa.02/|archive-date=2015-10-05}}</ref>

During a presentation at the [[Computers, Freedom and Privacy Conference|Computers, Freedom and Privacy]] 2000 (CFP2000) conference, [[Duncan Campbell (journalist, born 1952)|Duncan Campbell]], senior research fellow at the [[Electronic Privacy Information Center]] (EPIC), mentioned the {{tt|_NSAKEY}} controversy as an example of an outstanding issue related to security and surveillance.{{Citation needed|date=September 2011}}

In addition, Dr. Nicko van Someren found a third key in Windows 2000, which he doubted had a legitimate purpose, and declared that "It looks more fishy".<ref>{{cite web|title=How NSA access was built into Windows|url=http://www.heise.de/tp/r4/artikel/5/5263/1.html|last=Campbell|first=Duncan|author-link=Duncan Campbell (journalist, born 1952)|date=1999-01-04|website=Heise Online|publisher=Heise Medien}}</ref>

== Microsoft's reaction ==

Microsoft denied the [[Backdoor (computing)|backdoor]] speculations on {{tt|_NSAKEY}} and said "This speculation is ironic since Microsoft has consistently opposed the various [[key escrow]] proposals suggested by the government." According to Microsoft, the key's symbol was "{{tt|_NSAKEY}}" because the NSA was the review authority for [[Export of cryptography from the United States|U.S. cryptography export controls]].<ref>{{Cite web|title=Microsoft Says Speculation About Security and NSA Is "Inaccurate and Unfounded"|url=http://www.microsoft.com/en-us/news/press/1999/sept99/rsapr.aspx|date=3 September 1999|website=News Center|publisher=[[Microsoft]]|location=Redmond, WA|url-status=dead|archive-url=https://web.archive.org/web/20121024225124/http://www.microsoft.com/en-us/news/press/1999/sept99/rsapr.aspx|archive-date=24 October 2012}}</ref><ref name="NoBackdoor"/>

Richard Purcell, Microsoft's Director of Corporate Privacy, approached Campbell after his presentation and expressed a wish to clear up the confusion and doubts about {{tt|_NSAKEY}}. Immediately after the conference, Scott Culp, of the Microsoft Security Response Center, contacted Campbell and offered to answer his questions. Their correspondence began cordially but soon became strained; Campbell apparently felt Culp was being evasive and Culp apparently felt that Campbell was hostilely repeating questions that he had already answered. On 28 April 2000, Culp stated that "we have definitely reached the end of this discussion ... [which] is rapidly spiraling into the realm of conspiracy theory".<ref>{{cite web |title=Windows NSAKEY Controversy |publisher=Rice University |url=http://www.stat.rice.edu/~dobelman/kstorm.txt}}</ref>

Microsoft claimed the third key was only in beta builds of Windows 2000 and that its purpose was for signing Cryptographic Service Providers.<ref name="NoBackdoor">{{cite web |title=There is no "Back Door" in Windows |publisher=Microsoft |date=1999-09-07 |url=http://www.microsoft.com/technet/archive/security/news/backdoor.mspx?mfr=true |access-date=2007-01-07 |archive-url=https://web.archive.org/web/20000520001558/http://www.microsoft.com/security/bulletins/backdoor.asp |archive-date=2000-05-20}}</ref>

=== Further technical information ===

The [[Mozilla]] page on common questions on cryptography describes how Microsoft signs CSPs:
<blockquote>
It is in fact possible under certain circumstances to obtain an export license for software invoking cryptographic functions through an API. For example, Microsoft's implementation of the Microsoft Cryptographic API (CryptoAPI) specification was approved for export from the US, even though it implements an API by which third parties, including third parties outside the US, can add separate modules ("Cryptographic Service Providers" or CSPs) implementing cryptographic functionality. This export approval was presumably made possible because a) the CryptoAPI implementation requires third party CSPs to be digitally signed by Microsoft and rejects attempts to call CSPs not so signed; b) through this signing process Microsoft can ensure compliance with the relevant US export control regulations (e.g., they presumably would not sign a CSP developed outside the US that implements strong cryptography); and c) Microsoft's CryptoAPI implementation is available only in executable form, and thus is presumed to be reasonably resistant to user tampering to disable the CSP digital signature check.<ref>{{Cite web |url=http://www.mozilla.org/crypto-faq.html |title=Mozilla Crypto FAQ |access-date=12 April 2020 |archive-url=https://web.archive.org/web/19990422142445/http://www.mozilla.org/crypto-faq.html |archive-date=22 April 1999 |url-status=live }}</ref>
</blockquote>

According to Fernandes, it is possible to replace {{code|_NSAKEY}}. When loading a cryptographic module, the {{code|crypto_verify}} function first tries using {{code|_KEY}} to verify the module, then {{code|_NSAKEY}}. Since no cryptographic modules in Windows are signed with {{code|_NSAKEY}}, it never gets used. Replacing it with a different key allows non-US companies to install their crypto services into Windows without Microsoft's or the NSA's approval.<ref name="Cryptonym" />

=== Further speculation ===

Microsoft stated that the second key is present as a backup to guard against the possibility of losing the primary secret key. Fernandes doubts this explanation, pointing out that the generally accepted way to guard against loss of a secret key is [[secret splitting]], which would divide the key into several different parts, which would then be distributed throughout senior management. He stated that this would be far more robust than using two keys; if the second key is also lost, Microsoft would need to patch or upgrade every copy of Windows in the world, as well as every cryptographic module it had ever signed.{{cn|date=March 2024|reason=No citation from Fernandes}}

On the other hand, if Microsoft failed to think about the consequences of key loss and created a first key without using secret splitting (and did so in secure hardware which doesn't allow protection to be weakened after key generation), and the NSA pointed out this problem as part of the review process, it might explain why Microsoft weakened their scheme with a second key and why the new one was called {{tt|_NSAKEY}}. (The second key might be backed up using secret splitting, so losing both keys should not be a problem.) Another possibility is that Microsoft included a second key to be able to sign cryptographic modules outside the United States, while still complying with the BIS's EAR. If cryptographic modules were to be signed in multiple locations, using multiple keys is a reasonable approach. However, no cryptographic module has ever been found to be signed by {{tt|_NSAKEY}}, and Microsoft denies that any other certification authority exists.{{cn|date=March 2024}}

[[Bruce Schneier]] believes that the above type of concern, i.e. NSA putting a key in Windows so it can load arbitrary backdoored CSPs, is unfounded. He argues that there are easier ways of backdooring Windows that do not involve using an additional key, let alone one called "NSAKEY" in debug symbols visible to the whole company: the NSA could just ask for the main key. The crypto API is also a poor point of entry, as it requires the victim to run an NSA-supplied executable.<ref>{{cite web |title=NSA Key in Microsoft Crypto API? |first=Bruce|last=Schneier |publisher=Counterpane |date=1999-09-15 |url=http://www.schneier.com/crypto-gram-9909.html#NSAKeyinMicrosoftCryptoAPI |access-date=2007-01-07}}</ref>

== Key values ==

<!-- Both keys have been converted from the PGP keys (described further in the article) via https://cirw.in/gpg-decoder/ -->

Both keys are RSA keys with an ''e'' equal to 65537, which is a [[65,537#Applications|standard choice]].<ref>{{cite web | title=DomainKeys Identified Mail (DKIM) Signatures | website=IETF | date=1970-01-01 | url=https://www.ietf.org/rfc/rfc4871.txt | access-date=2024-12-12}}</ref>

'''_KEY''' has an ''n'' of:
<pre>b273e277a9c375c70bb7493e52b0b36962e976626ad609ba31be6accac12f1f3da6c18d96951820c457c7b4c4893bd149de279a39f6ec926d3544db3491fa2e9af1bf8260b3b0fbadd69cbd77b28012925711b17c0b877eaf7da9d02dd5f8572854e5c90e9b10cfbaeaf8b8fe1df5047bc18829a531499bbf49e8021346b5095</pre>

'''_NSAKEY''' has an ''n'' of:
<pre>ba8e15fee3cd160fb47cf93e2b4d842615af23f0659264d81edc35a27d3aa450890a227b561da401ff3908771d243f6eeb4f9e351976e90f07fd22cd099ccd71e85b97f5439adb172d32d71cb66c26c5b188a3e11790ed01eb31bf27bc667b396fd8283097d8b3869cc7511a3496e829a32bbad6d2f7aa7e8ca9805d51682d1f</pre>

== PGP keys ==

In September 1999, an anonymous researcher reverse-engineered both the primary key and the _NSAKEY into [[Pretty Good Privacy|PGP]]-compatible format and published them to [[key server (cryptographic)|key servers]].<ref>{{cite web |title=The reverse-engineered keys |publisher=Cypherspace |date=1999-09-06 |url=http://cypherspace.org/adam/hacks/ms-nsa-key.html |access-date=2007-01-07}}</ref>

=== Primary key (_KEY) ===

<pre>
Type Bits/KeyID Date User ID
pub 1024/346B5095 1999/09/06 Microsoft's CAPI key <postmaster@microsoft.com>

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i

mQCPAzfTc8YAAAEEALJz4nepw3XHC7dJPlKws2li6XZiatYJujG+asysEvHz2mwY
2WlRggxFfHtMSJO9FJ3ieaOfbskm01RNs0kfoumvG/gmCzsPut1py9d7KAEpJXEb
F8C4d+r32p0C3V+FcoVOXJDpsQz7rq+Lj+HfUEe8GIKaUxSZu/SegCE0a1CVABEB
AAG0L01pY3Jvc29mdCdzIENBUEkga2V5IDxwb3N0bWFzdGVyQG1pY3Jvc29mdC5j
b20+iQEVAwUQN9Nz5j57yqgoskVRAQFr/gf8DGm1hAxWBmx/0bl4m0metM+IM39J
yI5mub0ie1HRLExP7lVJezBTyRryV3tDv6U3OIP+KZDthdXb0fmGU5z+wHt34Uzu
xl6Q7m7oB76SKfNaWgosZxqkE5YQrXXGsn3oVZhV6yBALekWtsdVaSmG8+IJNx+n
NvMTYRUz+MdrRFcEFDhFntblI8NlQenlX6CcnnfOkdR7ZKyPbVoSXW/Z6q7U9REJ
TSjBT0swYbHX+3EVt8n2nwxWb2ouNmnm9H2gYfXHikhXrwtjK2aG/3J7k6EVxS+m
Rp+crFOB32sTO1ib2sr7GY7CZUwOpDqRxo8KmQZyhaZqz1x6myurXyw3Tg==
=ms8C
-----END PGP PUBLIC KEY BLOCK-----
</pre>

=== Secondary key (_NSAKEY and _KEY2) ===

<pre>
Type Bits/KeyID Date User ID
pub 1024/51682D1F 1999/09/06 NSA's Microsoft CAPI key <postmaster@nsa.gov>

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i

mQCPAzfTdH0AAAEEALqOFf7jzRYPtHz5PitNhCYVryPwZZJk2B7cNaJ9OqRQiQoi
e1YdpAH/OQh3HSQ/butPnjUZdukPB/0izQmczXHoW5f1Q5rbFy0y1xy2bCbFsYij
4ReQ7QHrMb8nvGZ7OW/YKDCX2LOGnMdRGjSW6CmjK7rW0veqfoypgF1RaC0fABEB
AAG0LU5TQSdzIE1pY3Jvc29mdCBDQVBJIGtleSA8cG9zdG1hc3RlckBuc2EuZ292
PokBFQMFEDfTdJE+e8qoKLJFUQEBHnsH/ihUe7oq6DhU1dJjvXWcYw6p1iW+0euR
YfZjwpzPotQ8m5rC7FrJDUbgqQjoFDr++zN9kD9bjNPVUx/ZjCvSFTNu/5X1qn1r
it7IHU/6Aem1h4Bs6KE5MPpjKRxRkqQjbW4f0cgXg6+LV+V9cNMylZHRef3PZCQa
5DOI5crQ0IWyjQCt9br07BL9C3X5WHNNRsRIr9WiVfPK8eyxhNYl/NiH2GzXYbNe
UWjaS2KuJNVvozjxGymcnNTwJltZK4RLZxo05FW2InJbtEfMc+m823vVltm9l/f+
n2iYBAaDs6I/0v2AcVKNy19Cjncc3wQZkaiIYqfPZL19kT8vDNGi9uE=
=PhHT
-----END PGP PUBLIC KEY BLOCK-----
</pre>

==See also==

* [[IBM Notes#Security|Lotus Notes]] – openly used an NSA key in order to comply with cryptography export regulations
* [[Clipper chip]]

== References ==
{{Reflist}}
{{Use dmy dates|date=February 2021}}

{{Microsoft Windows family}}
{{Microsoft}}

{{DEFAULTSORT:Nsakey}}
[[Category:1999 in computing]]
[[Category:Microsoft criticisms and controversies]]
[[Category:History of cryptography]]
[[Category:Conspiracy theories in the United States]]
[[Category:National Security Agency]]
[[Category:Microsoft Windows security technology]]
[[Category:Articles with underscores in the title]]