Re: Bank information protected by 40-bit encryption....

[Jeff Barber <jeffb@sware.com>]

Daniel R. Oelke writes:
> If you are the worring sort (or are looking for a ripe target)
> point your browser at:
>     https://www.diginsite.com/clients.html
> 
> There is a list of 23 Credit Unions - some (or all) of which
> allow transactions to be done over the net.
> 
> A brief once over shows that it requires Netscape 2.0 or 
> better so you will have encryption, but it does not warn you 
> when you are using only a 40-bit session key vs. a 128-bit key.
> (Netscape wizards - is there a way that the server can detect
>  this so that a warning message could be put up?)

Yes.  Netscape servers pass three (additional) environment variables to
CGI programs when used with SSL.  For a 40-bit invocation, you get:

    HTTPS=ON
    HTTPS_KEYSIZE=128
    HTTPS_SECRETKEYSIZE=40

So, you can distinguish 40- versus 128-bit usage.


-- Jeff