Interactive Week exclusive - White House to launch "Clipper III"

The White House is about to answer recent attempts to liberalize encryption
exports with a proposal of its own.

Documents obtained by Interactive Week show the Ciinton Administration has
been lobbying key Republican committee members to compromise on encryption
through a policy that looks very much like previous commerical key escrow
efforts.

This time, however, the administration has proposed a new, licensed network
of certification authorities and escrow agents to control access to strong
encryption abroad.

The newest proposal is contained in a 24-page White Paper, a draft of which
hit Capitol Hill earlier this week.

Much of the administration's "key management infrastructure" assumes a
similar network of certification authorities abroad. CAs would link public
keys to their owners, and could serve as escrow agents for users' private
keys, as well. The two would not have to be under the same roof, however.

An overarching "Policy Approving Authority" would supervise all subordinate
CAs and escrow agents.

Since US escrow of exported products pose well-known problems for privacy
and business concerns, the US is proposing foreign governments get into the
act as well. If other governments acted as escrow agents, the Clinton White
House argues, interlocking agreements among governments would protect all
their common security concerns while giving non-US citiczens access to US
encryption products.

The ultimate goal, the White House says, is to allow export of anything at
all, so long as keys are escrowed with an agent of its approval.

The White House is evidenty relying on OECD initiatives for much of this to
happen.


Specifically, the "Clipper III" paper says that:

                U.S. companies can export software programs that use keys
that are 64 bits
                of data long, if they agree to escrow keys that unlock the
encryption in the
                U.S. or with an appropriate agency abroad.

                 Manufacturers can export hardware that use 80-bit keys to
encrypt data, if
                keys are escrowed.

                 Large U.S. companies can escrow keys and not rely on third
parties.

Reaction is as before. Civil libertarians are already denouncing the White
Paper, while pro-escrow forces are praising it. Staffers to Commerce and
Judiciary committee call it the same old proposal, but with a large
bureaucracy behind it.

Quoted in the Interactive Week article: David Sobel of Electronic Privacy
Information Center, Dorothy Denning og Georgetown U. and  Stewart Baker,
former NSA counsel. Hill staffers also quoted on background.


The URL for the complete article is:
http://www.zdnet.com/intweek/daily/960518y.html

Will Rodger
Washington Bureau Chief
Interactive Week

Excerpts from internet.cypherpunks: 18-May-96 Interactive Week exclusive
.. by Will Rodger@interramp.co 
> The White House is about to answer recent attempts to liberalize encryption
> exports with a proposal of its own.
[...]
> The newest proposal is contained in a 24-page White Paper, a draft of which
> hit Capitol Hill earlier this week.

Kudos to Will for running this story. Today I snagged a copy of the
White Paper, which comes with 12 pages of tortured crypto-justifications
and 12 pages of appendices, with darling hierarchial diagrams of how
U.S. and foreign certification authorities will interact. (Hint: The
PAA, or Policy Approving Authority, is at the root of each country's or
region's certification hierarchy.)

It's very anti-anonymity: "Without a KMI of trusted certifying
authorities, users cannot know with whom they are dealing on the
network..."

And not very cypherpunkly: "A number of principles need to be accepted
by government, industry and other users... Self escrow will be permitted
under specific circumstances. The escrow agent must meet performance
requirements for law enforcement access."

Basically, what the White Paper does is pay lip service to free market
competition and suggests loads of government/industry initiatives, but
it's always with the gummit wearing the steel gauntlet beneath the felt
gloves. It concludes by promising industry a transition into unlimited
key-lengthy export, provided they follow the rules:

"As trusted partners, industry and government can share expertise and
tackle intractable problems such as the insecure operating system. In
times past, the cryptographic algorithm was the core of the solution:
now it is the easy part. The debate over algorithms and bit lengths
should end: it is time for industry and govenrments to work together to
secure the GII in such a way that does not put the world at risk."

-Declan