NIST GAK export meeting, short version

I just got back from the NIST GAK export meeting. This is
a short writeup of a summary. I'll post a longer version later
this evening or early tomorrow morning.

The meeting was hosted by Ed Roback of NIST, who quickly introduced
Mike Nelson of the White House. Mike is clearly a political guy.
His handout says: "We believe that our proposal for exportable 64-bit key
escrow encryption meets these goals [the goals of VP Gore's letter to Rep
Cantwell, July 20, 1994]." He said that the criteria describe a solution,
but not the only solution.  He said it does not preclude other
implementations in the future. He anticipates that the State Department
will issue guidance based upon these criteria in "early 1996," and that
between now and then, any product that meets the criteria will be elegible
for expidited approval. Of course, the existing (slow as molasass) process
will continue.

I asked the first questions from the floor. The two questions were:
(1) Is this meeting concerned solely with export
of software, or does it deal with controling domestic use of strong
cryptography? and (2) since the 64-bit limit was severly criticized at
the Sept meeting, why is it still needed if there is also escrow?

His answer was that there is "no intention to control domestic encryption"
and on the 64-bit issue, that the government is "not certain it will
work." he says they "want to see it implemented and want to see
how it works" because 64-bit encryption is very strong. If the escrow
doesn't work, they don't want a lot of softare to be in widespread use.

He said that they have studied the encryption that is supposed to be widely
available on the Internet. He said that viewed by crypto experts, not
much is very good. He mentioned "two incidents" where Netscape had
weak implimentations. He feels that companies will not trust software
over the 'net. that they "want the US Government to say that 'this is
good enough'."

Clint Brooks, of NSA, then went over the revised criteria. He claimed that
they were surprized at the industry concern over "one product" for
worldwide markets. There were lots of questions. He eventually admitted
that because of the "one product" concern, export regulations will effect
domestic products. [all the more reason for Netscape to keep building ten
or whatever it is.]

Brooks admitted that it is impossible to prevent multiple encryption.
Cypherpunks would do that by using PGP and then sending it using GAK.
He said "as a person, you can set up a secure communication method, and
nothing can be done about it." His concern is not that smart people can
have stronger crypto, but that strong crypto will be easy and widely used.

He said that the 64-bit key limit is not meant to restrict RSA keys to
64-bits, but rather to restrict the session keys that are encrypted using
RSA. Unspoken was the assumption that the 2000 bit RSA secret key would
have to be escrowed.

There were some interesting (and bad IMHO) implications of interoperability.
I'll cover them more in the long version. Basically, they admitted that
the interoperability restrictions made it stupid to have an export
version, you should have a strong domestic version, and an international
version developed offshore for sale to the rest of the world.

They admitted that there can be no controls over export of data, so once
interoperating software is available both domestically and from offshore
sources, there is no value in the export controlled, crippled version.

My favorite policeman, Geoff Greiveldinger, then described the
characteristics of an acceptable key escrow agent. There was a long list
of criteria, all unseen before the meeting. The general reaction
of the audience was that these were "yet another set of criteria that
must be met." Geoff claimed that they were simply trying to address
the questions raised at the earlier meeting about who is an
acceptable escrow agent. One point that caused a lot of concern
was that at least one employee of the escrow agent has to have a SECRET
clearence.

Industry, with a few exceptions, soundly said that this is a dumb idea,
that there is no market, that the criteria are too hard, etc. Except
Padgett Petersen, representing Lockheed-Martin. He said that LM thought
that the criteria were just peachy. The  usual civil liberties folks
also soundly trashed it.

There was a representative from Netscape. He said that they, as a company
think this is a terrible idea. They oppose it now, and will be issuing
a company policy soon. I didn't catch his name, and couldn't find him
to get the obviously carefully prepared text. If someone from Netscape, are
you listening Jeff W? could get me the text, I'll add it to my writeup.

 ******************

What I think it means:

I believe that the government deeply wants to restrict domestic use of
strong encryption, but they have no legal justification for doing so.
They can't expect that they will get it if they go to Congress. So they
are attempting an end-arround using the export criteria, which they
_do control_. They hope that the pain of having multiple versions will be
so high that no vendor will bother, and all we'll have is crippled
software.

The usual civil liberties lobby folks (CDT, EPIC, etc.) want to
hold their own, industry sponsored meetings to develop workable systems.

I think that the real key is for everyone, worldwide to insist on
both strong crypto and interoperability. The Germans are already
writing fine software and making fast hardware. Microsoft and Netscape
can easily afford to do some of their development offshore. If the products
sell and are deployed, it won't matter what the govies want.

Pat

ps. there were a number of other cypherpunks in attendance. I hope
some will add their impressions of the day.

Pat Farrell    Grad Student      http://www.isse.gmu.edu/students/pfarrell
Info. Systems & Software Engineering, George Mason University, Fairfax, VA
PGP key available on homepage               #include <standard.disclaimer>

Pat Farrell wrote:
> He said that they have studied the encryption that is supposed to be widely
> available on the Internet. He said that viewed by crypto experts, not
> much is very good. He mentioned "two incidents" where Netscape had
> weak implimentations. He feels that companies will not trust software
> over the 'net. that they "want the US Government to say that 'this is
> good enough'."

  Was he able to name any companies that would not buy products without
the "US Government seal of approval"?  It seems kind of odd that he is
slamming Netscape for having had a weak implementation when he would love
to force everyone to have a "weak implementation".  I'm sure that he will
be happy to know that we have fixed these weaknesses.  :-)

> Clint Brooks, of NSA, then went over the revised criteria. He claimed that
> they were surprized at the industry concern over "one product" for
> worldwide markets. There were lots of questions. He eventually admitted
> that because of the "one product" concern, export regulations will effect
> domestic products. [all the more reason for Netscape to keep building ten
> or whatever it is.]

  Agreed.

> There was a representative from Netscape. He said that they, as a company
> think this is a terrible idea. They oppose it now, and will be issuing
> a company policy soon. I didn't catch his name, and couldn't find him
> to get the obviously carefully prepared text. If someone from Netscape, are
> you listening Jeff W? could get me the text, I'll add it to my writeup.

  I assume you are talking about the exact text of the statement that
our representative made at the meeting.  I will try to get it, but it
may take a day or two since they will be in DC until at least tomorrow.

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.

Thanks for the great summary, Pat.

> His concern is not that smart people can have stronger crypto, but that
> strong crypto will be easy and widely used. 

This is why the 4 horsemen arguments aren't very convincing.

We often tend to view things in fairly black and white terms:  either we
have privacy or we don't.  But even with strong crypto, most people won't 
have security because they'll screw it up.  (Anyone who has ever been in 
charge of creating accounts for other people knows what kinds of 
passphrases people will pick.)  And even the most concientous among us 
are still going to be vulnerable to physical attacks on our hardware or 
more exotic attacks like tempest.

The real questions here are (a) how easy will it be to automate
surveillance, and (b) how much is surveillance going to cost, not (c) is
surveillance going to be possible at all?

No matter what happens with the law, determined people will be able to 
protect their privacy fairly well.  And no matter how strong the tools 
are, the government will be very often be able to penetrate the defenses 
by physically tampering with a machine, getting one correspondent to sell 
out another, or whatever.

Without crypto, the price of surveillance is going to drop through the
floor.  It's a lot easier to filter email for suspicious key words than it
is to analyse voice traffic on the telephone.  But with crypto, the price 
of surveillance is going to go way up.  Sticking with the status quo 
isn't an option.

I'd feel a lot better if surveillance became more expensive.  I don't have
much faith in our legal protections against government surveillance. 
Sure, they can't introduce evidence into court if it was obtained with an
illegal wiretap.  But if they learn something interesting, they can trump
up an "anonymous tipster" and get a court order.  Who's watching the
watchdogs to make sure they're following the law?  The exclusionary rule
isn't much comfort if it depends on the police admitting that they
violated my rights.  But how else would I know about an illegal government
wiretap? 

How much surveillance is really taking place?  Who knows.  I do know that
if it becomes 10 or 100 times more expensive than it is now, there will 
probably be a lot less of it.

Pat Farrell writes:
> I just got back from the NIST GAK export meeting. This is
> a short writeup of a summary. 

(I should probably wait for a longer version, but what the hey...)

[...]
> (2) since the 64-bit limit was severly criticized at
> the Sept meeting, why is it still needed if there is also escrow?
[...]
> and on the 64-bit issue, that the government is "not certain it will
> work." he says they "want to see it implemented and want to see
> how it works" because 64-bit encryption is very strong. If the escrow
> doesn't work, they don't want a lot of softare to be in widespread use.

This answer sounds rather silly to me. Do they seriously doubt that the
escrow mechanism works (modulo MAB's observations about the LEAF), or expect 
us to believe that they do ?  Clinton Brooks' comments cited later by Pat
suggest a certain acceptance that enforcement will have its problems
(e.g. strong crypto tunnelling), but perhaps Greiveldinger somehow doesn't
officially share that view. Is there another interpretation of "working"
I'm missing here ?

-Futplex <futplex@pseudonym.com>
"I'm from the D.O.E. and I just need to leave this here temporarily"
	(from a political cartoon entitled "The 3 Biggest Whoppers")

On Tue, 5 Dec 1995, Futplex wrote:

> This answer sounds rather silly to me. Do they seriously doubt that the
> escrow mechanism works (modulo MAB's observations about the LEAF), or expect 

No.  They doubt that "software binding" works, ie are afraid someone will 
figure out an easy way to hack the software to by-pass the escrow mechanism.

> us to believe that they do ?  Clinton Brooks' comments cited later by Pat
> suggest a certain acceptance that enforcement will have its problems
> (e.g. strong crypto tunnelling), but perhaps Greiveldinger somehow doesn't
> officially share that view. Is there another interpretation of "working"
> I'm missing here ?
> 
> -Futplex <futplex@pseudonym.com>
> "I'm from the D.O.E. and I just need to leave this here temporarily"
> 	(from a political cartoon entitled "The 3 Biggest Whoppers")
> 

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin@law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's warm here.

> 
> 
> I just got back from the NIST GAK export meeting. This is
> a short writeup of a summary. I'll post a longer version later
> this evening or early tomorrow morning.

Pat did not mention the first thing I observed.

Attendence was roughly 20% (yes, one fifth) of September.

ISTM industry is tired of hearing the same words in a different order.

-- 
A host is a host from coast to coast.................wb8foz@nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433