The demand for evidence in the wake of all the NSA leaks is laughable.[0] What does evidence of the NSAKEY being a backdoor look like to you, a provably malicious CSA shim, signed by the key, hand delivered by James Clapper?
I'll tell you what it looks like to me:
After the debug symbol is found, Microsoft gives a seemingly very stupid explanation for it[1]: "It is a backup key. Yeah, uhhhh... during the export control review - the NSA said that we had to have a backup key, so we named it after them..." After being challenged on the plausibility of their backup scheme they refuse to provide any further explanation.
Here is the funny part: Microsoft might be technically telling the truth about it being a "backup". Consider what else was going on around this period: ridiculous export controls on key-length, the clipper chip... and finally: government managed private-key escrow[2]. At that time the export regulations did not specify a backup requirement, and yet Microsoft claims otherwise. You know who else was talking a lot about backups? The Whitehouse, in its proposal for allowing the export of key-lengths above 56-bits - so long as applicants implement "key-recovery".[3] Somehow I don't think that we share the same definition of the word "backup".
Also, ECI Sentry Raven[4], have fun with that.
[0] https://assets.documentcloud.org/documents/784280/sigint-ena...
[1] https://cryptome.org/nsakey-ms-dc.htm
[2] https://web.archive.org/web/20000818204903/https://csrc.nist...
[3] https://epic.org/crypto/key_escrow/key_recovery.html
[4] https://archive.org/details/nsa-sentry-eagle-the-intercept-1...
I'll tell you what it looks like to me:
After the debug symbol is found, Microsoft gives a seemingly very stupid explanation for it[1]: "It is a backup key. Yeah, uhhhh... during the export control review - the NSA said that we had to have a backup key, so we named it after them..." After being challenged on the plausibility of their backup scheme they refuse to provide any further explanation.
Here is the funny part: Microsoft might be technically telling the truth about it being a "backup". Consider what else was going on around this period: ridiculous export controls on key-length, the clipper chip... and finally: government managed private-key escrow[2]. At that time the export regulations did not specify a backup requirement, and yet Microsoft claims otherwise. You know who else was talking a lot about backups? The Whitehouse, in its proposal for allowing the export of key-lengths above 56-bits - so long as applicants implement "key-recovery".[3] Somehow I don't think that we share the same definition of the word "backup".
Also, ECI Sentry Raven[4], have fun with that.
[0] https://assets.documentcloud.org/documents/784280/sigint-ena...
[1] https://cryptome.org/nsakey-ms-dc.htm
[2] https://web.archive.org/web/20000818204903/https://csrc.nist...
[3] https://epic.org/crypto/key_escrow/key_recovery.html
[4] https://archive.org/details/nsa-sentry-eagle-the-intercept-1...