23

Microsoft employee Raymond Chen says that an encrypted copy of Microsoft Bob is included on the Windows XP CD to take up space.

But Windows XP doesn't take up the entire CD; there is a lot of free space remaining.

Is the story true?

Improve this question
10
  • 10
    According to the article, the copy of Bob was not to "take up the entire CD", but to create "ballast data" for the Windows Installer to verify.
    – Dour High Arch
    Dec 16, 2012 at 4:51
  • 12
    Given the source, I'd say this is probably true.
    – Arkady
    Jan 24, 2013 at 14:02
  • 4
    ...yet unverifiable. A disk image, encrypted, is (should be) undistinguishable from random noise. Therefore, unless the (unknown) passphrase somehow surfaces (improbable), there is no useful way to verify this.
    – Piskvor left the building
    Mar 13, 2015 at 16:07
  • 1
    «A disk image, encrypted, is (should be) undistinguishable from random noise.» not necessarily, given that commonly used encryption algos of the era were later discovered to be susceptible to cryptanalysis.
    – vartec
    Mar 16, 2015 at 21:41
  • 2
    @vartec, 3DES with 168-bit keys provides 112 bits of security; it's only the two-key variant (112-bit keys) that only provides 80 bits of security. All cryptanalytic attacks on DES and 3DES require enormous numbers of chosen or known plaintexts, a situation that doesn't apply here. There's no known attack that will let you inspect a single set of data and decide if it's a collection of random numbers or a DES/3DES-encrypted message.
    – Mark
    Oct 6, 2021 at 0:06

1 Answer 1

Reset to default
4

This is very likely to be true

This story is verified by the programmer, Dave Plummer, who included the encrypted copy of Bob on the XP installer. He talks about it in a video on his YouTube channel here. According to him he needed a large blob of uncompressible data that he could be sure that the company had the legal rights to. Since Microsoft at the time of Bob was distributed by floppy disc, they put a great deal of effort into compressing installers as much as possible, this seemed to him to be a sensible source of such data. And he thought it was funny. He then encrypted the code through several encryption programs before using it and putting in on the XP installation CD.

But impossible to verify

After encryption that data is indistinguishable from random noise, so the only way to verify this would be to unencrypt Microsoft Bob from an XP installation CD. However, as Dave Plummer states that he has lost the passwords used for encryption, this is not possible.

Improve this answer

You must log in to answer this question.