Referrences to SKE and GAK

>From: tcmay@netcom.com (Timothy C. May)
>Date: Sun, 2 Oct 1994 20:31:13 -0700 (PDT)

>And I think we have indeed seen things coming before a lot of others
>did. The latest such alert, by Carl Ellison, myself, and others, is
>about "software key escrow," or what Carl dubs "GAK" (government
>access to keys). I think SKE is the wave of future repression, worth
>starting to fight now. The popular media is largely oblivious to it,
>as usual.  (John Markoff, of the NY Times, is on top of it, more so
>than most of us, and is waiting for the right time to do something on
>this.)


As someone at TIS actively involved in looking at SKE and related
technology, I find it bothersome that Tim keeps mixing the terms SKE and
GAK.  I'm not a fan of giving government access to civilian keys, no matter
what form it takes.  However, my mother was an English major and she taught
me to be protective of the language.

	escrow - n - a deed, a bond, money or a piece of property held in
	trust by a third party to be turned over to the grantee only upon
	the fulfillment of a condition

From inside this morass, there are so many options with so many gradations
that it's important to keep terms well defined and separate.  Try this:

KE:	key escrow, implementation and grantee unspecified

HKE:	key escrow, in hardware, grantee unspecified

SKE:	key escrow, in software, grantee unspecified

KEG:	key escrow, implementation unspecified, government grantee

GAK:	government access to keys, method unspecified

GAK is clearly more general than KE and even more general than SKE.  There
is a real danger that (KE/HKE/SKE) could be subverted by the government but
there are some real uses (as have been pointed out here) for what Steve
Walker (the TIS president) calls a "spare key in the wallet".  [I'm hoping
to get his paper on the subject on our FTP or Web server -- will tell
people when it's there.]  A spare key version of SKE would have the key's
owner as grantee -- leaving the gov't out of the loop *except through
normal subpoena and search warrant access*.

My predictions:

	1.	access by subpoena is still too objectionable for
		many people and isn't likely to fly;

	2.	surveillance agencies are not served by these mechanisms
		so they are not likely to welcome such systems.

Meanwhile, NSA access isn't covered by any of these terms, except perhaps
GAK.  This is relevant since at the last KEA meeting (NIST's "Key Escrow
Approaches"), TIS SKE was demonstrated and people from industry were asked
if they wanted to participate in an experiment -- put it in some product,
let some gov't agency be the guinea pig user community and see if the FBI
was happy with the result (this would be SKEG -- SKE with gov't as grantee)
-- and the response was that there was *no* interest unless this provided
a way to get software exported.  Mike Nelson of the White House (their
point man on Clipper, etc.) and Clint Brooks of NSA replied with a resounding
"we'll have to think about that".  [There has been no result of such thinking
yet.]

The sequence of events is:

1.	industry wants to export
2.	NSA controls export
3.	industry appears ready to do all sorts of things (like provide GAK)
	in order to get export permission
4.	the NSA doesn't get its needs met by SKEG (because the SKEG mechanisms
	can be circumvented, leaving normal S/W without GAK)
5.	the current situation is an impasse
6.	the forces of the dark side are so desperate to get GAK that
	they'll look at anything which might get them there

-------

So, there's a real reason to watch SKEG developments.  There's also a real
reason to get a new Cantwell bill passed.

At the same time, although the term KE is tainted by NIST/NSA/FBI misuse,
there do exist positive uses for KE (especially SKE) *without* the gov't as
grantee.  I encourage individuals to give this a little thought.  The
example Steve Walker keeps using in public is "the second time I locked
myself out of my car, I decided to carry a spare key in my wallet".


[...]

>Dorothy Denning is deeply involved with SKE, 

Dorothy has seen the TIS SKE demo.  Involvement other than that is none, at
least on TIS's side, except that she provided one suggestion to the three
TIS developers (Dave Balenson, Steve Lipner and Steve Walker) during the
design stage (in early May I believe).

BTW, my name appears on the TIS SKE paper because I added a variant -- the
escrow-less option.  That is, instead of having a private key in escrow for
the FBI to get and use forever, have the sender split his session key into
KS1 and KS2 (KS = XOR(KS1,KS2)) and encrypt each half for a different
escrow agent.  [That term is already a misnomer in this case, since these
"escrow agents" have no databases of keys and therefore escrow nothing.  I
tell you, this morass has done major damage to the English language, all
because the gov't perpetrators are afraid to say what they really mean, in
plain English!]  LE would then have to send a piece to each escrow agent
for each message -- letting the agents do traffic analysis on FBI efforts
and also giving out no key lasting beyond a wiretap court order.  As with
anything else, when faced with a technical problem, if I see solutions I
offer them.  [PRZ tells a story of an engineer being led to a gallows which
has been malfunctioning, letting people go free (through a presumed act of
God) -- looking at it and saying "Oh, I see the problem".  (sorry if I
ruined the joke with abbreviation)]

ob.polit.: I don't mind GAK if it is applied only to the military and
various executive agencies, as Clipper/Capstone now appears to be.  Those
people have already given up rights to private communications.  However,
for military uses of Capstone, it bothers me as a citizen to see the keys
kept by Treasury and NIST.  I'd rather see them kept by NSA and Fort Knox
(and I've said so, to Mike Nelson among others).

For private citizens, I intend to fight to my last breath any attempt to
declare a government right to our keys.  I also intend to fight attempts to
declare that the public is volunteering to go along with GAK.  I don't buy
that and I'm in a position to see if it were true.

>					      working with Miles Schmid
>of the NSA 

Miles is with NIST (or was this a snide comment on NIST? :-).

>	    and the folks from Trusted Information Systems (according
>to Whit Diffie, who saw a joint presentation by the bunch of them in
>Karlsruhe, and their glee that the Micali escrow patent will likely be
>overturned due to prior art in Europe).

The TIS SKE stuff was presented at several places, most recently the
CSS&PAB.  The new thrust by Steve Walker is that the public has no reason
to buy KEG products.  They add no value to the consumer.  However, the
public *has* a reason to buy spare-key-in-the-wallet systems.  Given the
existence of a redundant place to find a message key (or to get it
decrypted), law enforcement could mine that database, using existing
legal mechanisms (subpoena and search warrant).  [This access does
not meet the desires of covert surveillance, however, so it's likely
to be rejected.]

 - Carl

Thanks to Carl for an interesting essay on key escrow.

What is being escrowed in the SKE proposals?  Is it the session key?
What is the advantage to the user of broadcasting a session key encrypted
to an escrow agent?  That does not sound like a spare key in the wallet.

What about the aspect of SKE which allows compliant implementations to
verify that the session key is actually being honestly reported to the
escrow agent?  Isn't that where most of the cryptographic challenge and
interest comes from, and again how does that benefit the customer?  It
seems strictly for the benefit of wiretappers.

What about key escrow systems which allow users to store encrypted
versions of their public keys?  There would still be the danger of the
user dying or forgetting his pass phrase, but in many circumstances
that is tolerable.  The KE agency then simply becomes a data backup
facility.  Is TIS working on this?  This seems like the true analog of
the spare key in the wallet.

I get the impression that despite all of the good and reasonable things
you can say about key escrow, the actual work and interest is strictly
going towards systems to allow government wiretapping.  No significant
efforts are going into these other ideas which might be useful to the
customer but are irrelevant to the wiretapping issue.  So I am afraid
that the actual work on SKE is only going to hurt privacy despite
Carl's hopes.

Hal

Carl,

I think the main problem here is that the government seized the
initiative by using "Key Escrow" when they really mean "Government
Access to Keys"; also, the infamous Gore->Cantwell letter refers to
SKE, but clearly means, from context, that they're referring to what
you refer to as KEG.  This makes it difficult to advocate key escrow
of any form without appearing to endorse "escrow" with the government
as the grantee.

Also:

One can divide the use of encryption in computer networks in two
classes:

 - encrypting real-time communications
 - encrypting stored data (files).

Key escrow in the former case is only useful in the presence of
wiretaps, since the encrypted data is ephemeral.

The business/commercial justification for key escrow (having a "spare
key" around) is really only applicable in the second case.

					- Bill

>Date: Wed, 05 Oct 1994 12:16:21 -0400
>From: Bill Sommerfeld <sommerfeld@orchard.medford.ma.us>

>I think the main problem here is that the government seized the
>initiative by using "Key Escrow" when they really mean "Government
>Access to Keys";

Exactly.  The term is tainted.

Meanwhile, the offense to the English language remains even if we give the
term up as tainted.  For example, there's a line in one of our publications
(the Data Security Letter) talking about this process:

	FBI representatives stressed concern that users not be able to use
	encryption products separated from the key escrow process.

That's true to the FBI's word choice.

So -- postulate a Key Escrow service with escrow agents chosen by Fidel
Castro and the Columbian drug cartel as grantee -- or, as an alternative,
postulate a PGP key provided by the FBI for good little boys and girls to
include as a recipient during encryption with PGP-voice.

Which one gives the FBI access?

 - Carl

P.S.  (I know: neither, because there aren't any good little boys and
girls, but I was talking about English semantics, not reality. :-)