RE: Questions about Microsoft and Software Key Escrow

From: Jacob Levy

I respect your feelings on the matter and your ability to think clearly and
with great foresight also :-), but for this list it would probably be much
more useful if we got some _OFFICIAL_ answer from Microsoft instead of your
"I believe, I cannot think, can't see", etc. etc. You're obviously a
concerned individual but you equally obviously don't claim to speak for
Microsoft.
................................................

Thanks, Jacob.   I don't speak for Microsoft, but I can speak based on 
impressions I have accumulated from internal correspondence between 
employees and misc. company communications to employees.  The company 
would suffer turmoil from within, if it were the case that privacy had 
been compromised.  Programmers are just like you & me, right?

Anyway, I personally can't see the very existence of a system of key 
escrow is an evil which should be apprehended and stopped.   In concert 
with the idea of liberty & freedom to develop ideas and export crypto, 
I think the best offense is a good defense.   I would oppose the idea 
that anyone should be stopped from developing creative ideas on the 
principle that it would be contrary to the existence of intelligence on 
the planet.  I would oppose it if the government promoted it, and I 
would oppose it if any one else did, also.

Blanc

I don't see what "key escrow" is good for besides enabling wiretaps.  Am I
missing something here?

In any public-key system, even one without "key escrow", I know (or could
easily discover if I wanted to) my own private key.  Yes, I may want to make
some kind of "backup" arrangements for my key, to cover forgetfulness, death,
or whatever.  But that doesn't require anything in the communication/storage
formats (e.g., no LEAF field).  The managment of my private key is independent
of communication/storage of encrypted material.

"Key escrow", on the other hand, is about building into the
communication/storage formats a requirement that I use only keys that are
"escrowed".  I don't see what this adds, other than a requirement that my
communication/storage be interceptable with the cooperation of my "escrow
agents".

I'm thinking here about software schemes; by "any public-key system" I mean any
where the encryption is done by software.