problems with key escrow?

I was thinking about the problems that people have with escrowed keys and 
was wondering a few things.  For one, things like the clipper chip would 
not give law enforcement agencies any new abilities or powers - they are 
currently allowed to tap a phone conversation iff they have a court order 
to do so.  escrowed clipper keys would only be revealed if a court had 
decided that there was enough evidence against someone to justify a 
wiretap (and the accompanying keys).  so these could only be revealed in 
the case of criminal activity (or reasonable suspicion thereof), which 
means that most people wouldn't have anything to worry about.  now, is 
the real problem that the key escrow agency is the weakest link in the 
chain of security? that people don't trust the government having these 
things since they could quietly copy the database to the nsa? what about 
the possibility of having some organization like, but not necessarily the 
eff hold onto keys so that they would reveal them, or better, decrypt 
only in the case of a court order, but they would also make it publicly 
known if the nsa tried to claim they had an inherent right to all of the 
info.

I haven't really thought too much about this one way or the other, but I 
thought it would be worthwhile to get some others' opinions.
-Mike

--
Mike Sherwood
internet: mike@EGFABT.ORG     uucp: ...!sgiblab!egfabt!mike

Do you accept the claim that clipper is only for telephone
conversations? I certainly don't believe that once a digital encryption
algorithm is conveniently present in my digital network (clipper would
need a digital audio hookup and modem to work with analog phone lines)
I am going to abstain from using it for all my _other_ digital traffic,
like email and data. Especially if everyone I want to talk uses this
standard too, and there is some sort of key-exchange protocol we all
use that just happens to use clipper as well. Now anyone with my
escrowed key can automatically scan all my mail, bills,
library requests, software purchases, video checkouts, database
inquires, work that I telecomute on, etc (think about all info that
flows into or out of your house!). This is considerably more that can
be done now, and at a much lower than can be done today.


I consider this to be the greatest lie in the Denning / Slick Willy
party line on clipper. Most non-computer people do not appreciate the
power of standardization to coerce users to inferior or otherwise
undesirable standards, because everyone and every machine one needs to
interoperate with follows the standard, foul though it is. (As a DOS
developer, I am quite aware of this ;-) I wish the press would figure
this out, and challenge the SW's spokespeople on this.

Andy (andy@autodesk.com) speaking for self.

Mike Sherwood writes:

> I was thinking about the problems that people have with escrowed keys and 
> was wondering a few things.  For one, things like the clipper chip would 
> not give law enforcement agencies any new abilities or powers - they are 
> currently allowed to tap a phone conversation iff they have a court order 
> to do so.  escrowed clipper keys would only be revealed if a court had 

New Capability #1: Centralization of the whole process (in connection
with Digital Telephony) so that the process is much more automated,
much easier to do. (Recall that the Foreign Intelligence Surveillance
court--or a name similar to that--has never turned down a wiretap
request....have any of you _not_ sent something in e-mail to a foreign national?)

> decided that there was enough evidence against someone to justify a 
> wiretap (and the accompanying keys).  so these could only be revealed in 
> the case of criminal activity (or reasonable suspicion thereof), which 
> means that most people wouldn't have anything to worry about.  now, is 

New Capability #2: Easier tracking of who calls whom, and who is
called by whom. The Clipper system makes "pen registers" automatic.
Great for tracking down contacts the perps make.

> the real problem that the key escrow agency is the weakest link in the 
> chain of security? that people don't trust the government having these 
> things since they could quietly copy the database to the nsa? what about 

Well, left unsaid in the Clipper debate has been just this point: what
access will NSA and other intelligence agencies have to the key escrow
databases? It is hard to imagine that they will not have the
databases, one way or another.

(And innumerable other issues: How and where are backups kept? What
happens when a Clipper key is given to law enforcement and then the
investigation is over....will they buy the alleged perp a new Clipper
system? What will foreign countries think? Are they part of the deal?)

> I haven't really thought too much about this one way or the other, but I 
> thought it would be worthwhile to get some others' opinions.
> -Mike

New Capability #3: By making non-Clipper systems essentially
impossible to get export permits for, and by "greasing the skids" for
Clipper, the government essentially becomes the Phone Company. It
specifies the hardware, it forces competitors out of markets, and it
ends up using its power to crush alternatives.

New Capability #4: When Clipper inevitably fails to solve all
kidnapping and child porn cases, not to mention the downing of an
airliner with CIA-supplied Stinger missiles, the way will be paved for
the outlawing of non-escrowed key systems. (Alternate version: Once a
couple of high-profile cases _are_ solved because of Clipper, look for
the same outlawing of non-escrowed crypto.)

So,  here are several "new capabilities" which Clipper and its ilk
portent. Reason enough for all lovers of freedom and individual
dignity to reject it out of hand.

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."