Re: NSA key in MSFT Crypto API

[gnu () TOAD COM (John Gilmore)]

> > http://www.cryptonym.com/hottopics/msft-nsa.html
>
> Perhaps more interestingly, the program lets you replace the key, too.

Microsoft prevents third parties from installing un-authorized crypto
code under CAPI by checking the signature on the code.  Under their
export deal, they refuse to sign anyone's non-US code that does strong
crypto.  So if you want to add your own strong crypto, you need to sign
it with a key that the CAPI recognizes.  You could patch out Microsoft's
key but then the Microsoft modules won't load properly.  It works
better to patch out NSA's key with your own -- then you can load both
your own crypto code and all the standard MS stuff.

        John