Re: using PGP only for digital signatures

Pop Quiz: If you are a citizen of the U.S., prove it.


At 11:33 PM 11/4/95, Simon Spero wrote:
>On Sat, 4 Nov 1995, Derek Atkins wrote:
>
>> student from coming to the US.  By allowing the student into the US,
>> the gov't is implicitly giving them the right to use PGP within the
>> US.
>
>This is kind of a risky policy to take. The general feeling I get that
>allowing non green-card holders access to strong cryptography is sort of
>decriminalised, in that the police aren't likely to break down your door
>and have your AFS server accidentaly fall down stairs. However, it is
>still against the law, and could be used against the university in other
>unrelated circumstances.
>
>It seems that licences allowing foreign nationals access to cryptographic
>software within the US are pretty easy to get, and especially for
>something like PGP on a central machine.

We really need to put this one to bed.

As has been said several times recently, for the purposes of law, non-U.S.
citizens who reside in the U.S are effectively "U.S. persons." Subject to
U.S. law and generally having the same legal rights. (Can't vote. Can be
drafted. Must pay taxes. Must have a SSN. Must obey traffic laws. Must not
discriminate against the differently clued, etc.)

All of the nonsense about wearing a "munitions shirt" in front of a
"foreigner" seems to miss this essential point.

Ditto for PGP use.

Consider this: most people in the U.S. do not have a "credential" that
shows them to be U.S. citizens. (Hint: most people in the U.S. do not have
passports.) They have driver's licenses, which say nothing about
citizenship (at least California and Virgina licenses do not). Social
Security cards are the same.

(Second hint: most people are hard-pressed to locate a birth certificate
for themselves. Many people take the easy way out and simply buy a new one
for the $25 a good one costs.)

Therefore, there are few ways that citizenship can be "checked." Period. A
foreigner who wishes to "prove" his non-U.S. status could, of course, show
his green card. But this is different from proving citizenship.

As to the USF--or was it SFSU?--student worried about "allowing" PGP to be
used...I despair at this outlook. Why not simply ignore the issue, not
"give" them PGP, but instead have a few pointers to where PGP may be
gotten.

As to the point about students impersonating faculty, if the faculty starts
signing their messages (doubtful), then no one can impersonate _them_.
(Except that it sounds like all this PGP stuff is to happen on campus
computers, in which case there are several ways their private keys and
passphrases can be snarfed.) The issue of a "credential" for faculty
members, something that says "This person is a member of the Foo U.
faculty," well, this is a different kettle of fish; such credentials are
not part of the PGP system, though webs of trust could in principle be used
in a klugey kind of way.

--Tim May

Views here are not the views of my Internet Service Provider or Government.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
Corralitos, CA              | knowledge, reputations, information markets,
Higher Power: 2^756839      | black markets, collapse of governments.
"National borders are just speed bumps on the information superhighway."

On Sat, 4 Nov 1995, Timothy C. May wrote:

> Therefore, there are few ways that citizenship can be "checked." Period. A
> foreigner who wishes to "prove" his non-U.S. status could, of course, show
> his green card. But this is different from proving citizenship.
> 

And here we have the rub. People with permanent residency (i.e. green 
cards) are fully entitled to access to strong crypto. Most foreign 
students are on J-1 visas, which do not grant permanent residency. 

Simon

On Sat, 4 Nov 1995, Timothy C. May wrote:

> Pop Quiz: If you are a citizen of the U.S., prove it.
>...
> As has been said several times recently, for the purposes of law, non-U.S.
> citizens who reside in the U.S are effectively "U.S. persons." Subject to
> U.S. law and generally having the same legal rights. (Can't vote. Can be
> drafted. Must pay taxes. Must have a SSN. Must obey traffic laws. Must not
> discriminate against the differently clued, etc.)

All true.

> Consider this: most people in the U.S. do not have a "credential" that
> shows them to be U.S. citizens. (Hint: most people in the U.S. do not have
> passports.) They have driver's licenses, which say nothing about
> citizenship (at least California and Virgina licenses do not). Social
> Security cards are the same.
> 
> (Second hint: most people are hard-pressed to locate a birth certificate
> for themselves. Many people take the easy way out and simply buy a new one
> for the $25 a good one costs.)
> 
> Therefore, there are few ways that citizenship can be "checked." Period. A
> foreigner who wishes to "prove" his non-U.S. status could, of course, show
> his green card. But this is different from proving citizenship.

A green card, by itself, also fails to prove legal status.

Proving legal residency requires a combination of two documents, one each
from specified lists. Most commonly a driver's license, green card (which
is actually pink), or birth certificate from list A, and a social
security card from list B. 

Chris Hibbert's SSN FAQ talks a little bit about how this works, and why
it's a Good Thing. Basically, for privacy and security reasons, it is a
very good idea to separate the issues of identity and authorization.

I don't care how securely you can authenticate who I am -- by PGP, retinal
scan, whatever. I do not want a single digitizable token to be the key to
my identity. Even if that identity cannot be forged (and everything can be
forged), it can be used to track me, by the government, by the Direct
Marketing Association, by the private investigators of certain wacky
cults, and by TRW. And I suppose by those secret government types at SAIC
who, we are told, control the Internet now :-)

It is a little inconvenient, but this is why it's a Good Thing that you
need a separate driver's license, social security card, credit card, phone
number, PGP key, password, thumbprint, and retina. I would oppose moves to
combine them to a single unified "mark of the beast," as it were. I am a
little uneasy about the otherwise very cool First Bank of the Internet for
this reason. If you use FBOI, I'd recommend using a PGP key separate from 
your usual PGP key.

Crypto fans need to recognize that the ability to securely prove your 
identity is not an unmitigated advance.

Of course, all the crypto fans here are also pseudonym fans.

> As to the point about students impersonating faculty, if the faculty starts
> signing their messages (doubtful), then no one can impersonate _them_.
> (Except that it sounds like all this PGP stuff is to happen on campus
> computers, in which case there are several ways their private keys and
> passphrases can be snarfed.) The issue of a "credential" for faculty
> members, something that says "This person is a member of the Foo U.
> faculty," well, this is a different kettle of fish; such credentials are
> not part of the PGP system, though webs of trust could in principle be used
> in a klugey kind of way.

This is a job for private key cryptography, like kerberos.

-rich