Editing NSAKEY (section)

=== Further speculation ===

Microsoft stated that the second key is present as a backup to guard against the possibility of losing the primary secret key. Fernandes doubts this explanation, pointing out that the generally accepted way to guard against loss of a secret key is [[secret splitting]], which would divide the key into several different parts, which would then be distributed throughout senior management. He stated that this would be far more robust than using two keys; if the second key is also lost, Microsoft would need to patch or upgrade every copy of Windows in the world, as well as every cryptographic module it had ever signed.{{cn|date=March 2024|reason=No citation from Fernandes}}

On the other hand, if Microsoft failed to think about the consequences of key loss and created a first key without using secret splitting (and did so in secure hardware which doesn't allow protection to be weakened after key generation), and the NSA pointed out this problem as part of the review process, it might explain why Microsoft weakened their scheme with a second key and why the new one was called {{tt|_NSAKEY}}. (The second key might be backed up using secret splitting, so losing both keys should not be a problem.) Another possibility is that Microsoft included a second key to be able to sign cryptographic modules outside the United States, while still complying with the BIS's EAR. If cryptographic modules were to be signed in multiple locations, using multiple keys is a reasonable approach. However, no cryptographic module has ever been found to be signed by {{tt|_NSAKEY}}, and Microsoft denies that any other certification authority exists.{{cn|date=March 2024}}

[[Bruce Schneier]] believes that the above type of concern, i.e. NSA putting a key in Windows so it can load arbitrary backdoored CSPs, is unfounded. He argues that there are easier ways of backdooring Windows that do not involve using an additional key, let alone one called "NSAKEY" in debug symbols visible to the whole company: the NSA could just ask for the main key. The crypto API is also a poor point of entry, as it requires the victim to run an NSA-supplied executable.<ref>{{cite web |title=NSA Key in Microsoft Crypto API? |first=Bruce|last=Schneier |publisher=Counterpane |date=1999-09-15 |url=http://www.schneier.com/crypto-gram-9909.html#NSAKeyinMicrosoftCryptoAPI |access-date=2007-01-07}}</ref>