The Microsoft Windows _NSAKEY backdoor

Microsoft _NSAKEY is a signing key found in Microsoft's CryptoAPI since Windows 95. Many claimed this was the ultimate backdoor for the National Security Agency. But is this a hoax, or is this a real backdoor in Microsoft Windows?

If you like to protect yourself on the web and want to support my channel, sign up for NordVPN at https://nordvpn.org/thehatedone or use my coupon code 'thehatedone' at the checkout to save 75% on the 3-year plan!

A British researcher discovered that Microsoft was cryptographically signing its CryptoAPI with two keys. This means two separate entities could approve software running inside Windows. One of those entities was Microsoft. The identity of the other one remained a mystery.

But then Microsoft shipped a Service Pack 5 for WindowsNT4. Somebody down the chain of command at Microsoft forgot to remove information revealing the true identity of both of the signing keys. Chief security scientist at Ontario-based Cryptonym Andrew Fernandes found the names of the two keys. One was simply called “_KEY”. And the other was “_NSAKEY”.

Sources
News coverage
https://www.wired.com/1999/09/ms-denies-windows-spy-key/
https://archive.nytimes.com/www.nytimes.com/library/tech/99/09/biztech/articles/04soft.html
https://archive.nytimes.com/www.nytimes.com/library/tech/99/09/cyber/articles/04soft-side.html
http://us.cnn.com/TECH/computing/9909/13/backdoor.idg/index.html
http://edition.cnn.com/TECH/computing/9909/03/windows.nsa.02/
http://news.bbc.co.uk/2/hi/sci/tech/437967.stm
https://www.computerworld.com/article/2521889/microsoft-denies-it-built--backdoor--in-windows-7.html

Security experts & opinions
https://web.archive.org/web/20000617163417/http://www.cryptonym.com/hottopics/msft-nsa/msft-nsa.html
https://www.schneier.com/crypto-gram/archives/1999/0915.html#NSAKeyinMicrosoftCryptoAPI
https://www.heise.de/tp/features/How-NSA-access-was-built-into-Windows-3444341.html
http://www.stat.rice.edu/~dobelman/kstorm.txt
https://cryptome.org/nsakey-ms..