How I Would Ban Strong Crypto in the U.S.

At 12:18 AM 7/15/96, Dave Banisar wrote:
>Its now up at http://www.epic.org/crypto/key_escrow/wh_cke_796.html
>

Thanks. I took an initial look, and it looks like the same old stuff.

The report speaks of an "emerging consensus" (for key escrow). I see just
the opposite, unless the report is speaking only of the U.S. intelligence
and law enforcement community and its foreign counterparts. Business has
made it clear (cf. the several recent reports) that it is opposed to the
Administration's plan, and that if a market for some form of key escrow
exists (as it certainly does, in specific contexts), that the market can
supply the solution.

And certainly the civil liberties groups and groups such as ourselves are
not part of this "emerging consensus." Ditto for the "average man in the
street," as evidenced by opinion polls (I recall 80% opposition reported by
one of the newsweeklies, but don't quote me), by anecdotal reports (e.g.,
Zimmermann's tale of his discussions), and by opposition to Clipper I,
Clipper II, and now Clipper III.

A bunch of Congressmen, including the axis supporting the Burns bill,
obviously are not part of this emerging consensus.

The National Research Council report made it clear that a distinguished
panel of cryptographers, computer scientists, and policy professionals did
not think key escrow is desirable.

And the hundreds of folks in attendance at recent SAFE and NRC travelling
roadshows were obviously not in support of key escrow.

Business, civil liberties groups, professional organizations, and most Net
people are opposed to the Administration's key ecrow proposals (such as
they are understood to be, in Clipper I/II/III).

So, who is in this "emerging consensus"?

Moving on to the wisdom of imposing a government solution to what either is
or is not a market need, there is great danger in deploying even a
nominally (at this time) "voluntary standard." This is a danger many of us
have felt for years to be the main danger of nominally (and ostensibly)
"voluntary" systems.

Imagine a voluntary system supported and funded by the government, using
its power to limit exports and to "jawbone" foreign governments. (No time
here to examine the obvious issues--cf. the archives for many explications
over the past several years.)

Once widely deployed, and perhaps mandatory in countries like France,
Singapore, Iraq, and the like, it would take very little more to simply
pass a law restricting the non-escrowed alternative in the U.S.

(Sure, such a law might be unconstitutional, for the reasons we so often
discuss. Sure, there are many circumventions possible. Sure. The point is
not to rehash these points again but to indicate why Cypherpunks and civil
libertarians should NOT support any plan, even a "voluntary" plan, that
puts such power to set standards in the hands of the government. Even a
"signed promise" is not enough, given the dangers of "flipping a switch.")

Is this a plausible scenario, though? Well, were I in the LEA/TLA
community, this is what my fallback plan would probably be. Realizing that
a full-frontal ban on strong crypto, or crypto without backdoors, would not
fly at this time (unless Oklahoma II happens, in which case all bets are
off), and realizing that the plans for Clippers I, II, and III have been
fizzling, I would push for a relatively harmless-sounding "voluntary key
escrow" plan.

I would push hard on Netscape, Microsoft, Novell, Sun, Apple, and the other
companies (but mainly on Netscape and MS, for obvious reasons) to bundle in
"trusted third parties" and all that GAK stuff. Bundle it in, make it easy
to use, make it easy to export, make it easy to spread in crypto-hostile
countries, and hope like hell that it undermines the push for PGP and
S/MIME.

I would work closely with Mossad, GCHQ, SDECE, Chobetsu, Savak, and all the
other secret policemen of the world to make sure that while America might
remain an "island of strong crypto" for a while at least, that the same
could not be said of other countries. That is, I would work to help them
limit crypto use in their own countries to GAK-only forms.

(Those pesky survivalists, militia members, and ACLU folks in America could
keep using their Bass-o-matic and PGP  tools, but most of the rest of the
world would be mostly limited to GAK and New World Order software.)

Then, in about 2002 or so, depending on how many more serious terrorist
incidents have occurred, I would drop the hammer on strong crypto. Maybe an
Executive Order, maybe a state of national emergency, maybe a liberal
interpretation of the commerce clause, maybe an Act of Congress....

Once a New World Order-approved GAK system is widely deployed, outlawing of
"rogue cryptography" in the U.S. is more manageable.

That's what I would do.

(But not being on that side of the ideological fence, I will instead fight
GAK as I always have. And I will not be fooled by talk of how "Americans
will always be free any form of cryptography." Not when those same reports
from the Administration, and the testimony of Louis Freeh, etc., is in the
same breath taling about the need to stop pornographers from encrypting
their files, and so forth. Do they think we're stupid?)

Don't be fooled.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

At 09:58 AM 7/15/96 -0400, about six months ago, when Clipper III was new,
Raph Levien wrote:
>1. The battle over whether applications can contain strong encryption 
>algorithms has basically been lost. For example, SSL-enabled 
>applications are widely available over the world, thanks in large part 
>to the work of Eric Young. The same will happen for any other encryption 
>protocol that catches on.

Unfortunately, the Government hasn't given up on this one;
Peter Gutman's recent articles on export policy in New Zealand and
Australia suggest that Our Public Servants are trying an end-run
by getting those countries to stop export and development by productive 
crypto authors, targeting the toolkits that are being widely used
inside and outside the US.

>2. The battle for key management has not yet been fought. 

Yeah.  I haven't heard much from Clipper III recently,
since they've been trumpeting Clipper IV "Key Recovery" recently,
but that doesn't mean it's not going on.  Unlike politican efforts
such as Key Recovery, infrastructure attacks such as PKI
may require long-term technical development - the Cooperative
Research and Development Alliances (CRADAs) are not just to
bribe otherwise-valuable companies to stay out of the way,
they're to do things that may be sprung on us later;
I'd predict this coming summer.  For instance, back in July,
John Young quoted a Business Wire article about
 =  Toronto -- Certicom Corp. a leading information security 
 =  company, today announced that it will participate in an 
 =  initiative by the U.S. Commerce Department's National 
 =  Institute of Standards and Technology (NIST) which will 
 =  lead to the development of the elements of a public key 
 =  infrastructure (PKI).  
Certicom are the folks who do Elliptic Curve Cryptosystems,
which haven't been used much due to patent questions and 
RSA's dominance, but which allow much shorter public keys
and may have some speed advantages, both of which are
quite important for smartcard use.

>3. Anybody can write an application that supports strong encryption 
>algorithms. Witness SSH, a very impressive and useful program, which was 
>basically done by one person, Tatu Ylonen. However, building a key 
>management infrastructure will take lots of money, hard work, and 
>cooperation.
....
>4. Thus, the best leverage for the TLAs to win is to guide the 
>development of a key management infrastructure with the following 
>property: if you don't register your key, you can't play. I believe that 
>this is the true meaning of the word "voluntary:" you're free to make 
>the choice not to participate.
..
>6. Export is a two player game. The other country has to allow import of 
>the stuff, too. If the Burns bill passes, the "administration" would 
>strong-arm other countries to prohibit import of strong crypto, still 
>leaving US developers with no market.

It failed, and they've now got an Ambassador strong-arming other countries
to prohibit export.

>7. Building this stuff is too much of a task for the TLAs. They tried it 
>with Clipper, and it failed. They hoped that building the Tessera card 
>would be enough - that once they threw it over the wall, it would be 
>eagerly snapped up by industry.

>8. Thus, they're going to cajole, bribe, and coerce software companies 
>to play along. This fact is quite nakedly exposed in the document (good 
>thing the injunction against the CDA is still in force :-).

Yeah.  Clipper IV is getting a lot of people jumping on the bandwagon
to get export permission for their 56-bit software.  Many of the people
who are most vocal about it are the usual suspects anyway, but it's
closer to commercial usability that industry's more cooperative this round,
especially with more Internet money fever.

>> Don't be fooled.
>Who? Us cypherpunks?
>Raph
:-)

#			Thanks;  Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
#     (If this is a mailing list, please Cc: me on replies.  Thanks.)

> There has been some discussion at the last couple of crypto conferences
> about possible ways around this plan.  (I guess the idea goes back at
> least a year or two.)
> 
> One idea is to register a 2048 bit public key.  You have to give the
> secret key to the government in order to use the registry.  But what you
> do is to create a second key and embed it in the first.  It is, say, a
> 1024 bit key which is the lower half of the 2048 bit key.  It has
> different secret factors that nobody but you knows.  Then when people
> send you messages they encrypt using this modulus rather than the
> official one.
> 
> You get the benefit of the government-sponsored key certificate
> infrastructure, but the government is not able to crack your
> communications.

Sorry, but the government generates all keys.  Otherwise people might
mess up and choose insecure keys.

Tim May:
> 
> At 12:18 AM 7/15/96, Dave Banisar wrote:
> >Its now up at http://www.epic.org/crypto/key_escrow/wh_cke_796.html
{}
> The report speaks of an "emerging consensus" (for key escrow). I see just
> the opposite, unless the report is speaking only of the U.S. intelligence
> and law enforcement community....{}
{}
> So, who is in this "emerging consensus"?

Don't be so sure the FI community has any consensus within *its*
ranks, much less with the LE community. I've heard comments from
insiders that were 180 out with that concept.

[Not to mention that, in general, intercene warfare in the
Community is a much-practiced art.]

-- 
A host is a host from coast to coast.................wb8foz@nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433

On Sun, 14 Jul 1996, Timothy C. May wrote:

> So, who is in this "emerging consensus"?
> 
Foreign governments?  
(Process of elimination, not inside info...)



A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin@law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's hot here.  And humid.

Not really. At the last OECD meeting in Paris a couple of weeks ago, 
there was no great love by quite a few countries for key escrow. The 
scandavian countries were pretty united against and all sorts of other 
raised objections. (tho some of those objections were to the US 
ramrodding key escrow through OECD).

BTW. Those wizards at Wired have gotten our favorite spook Stewart Baker 
to write an article for an upcome issue talking about how the rest of the 
world save Japan loves key escrow and those big bad Japanese are 
thwarting the rest of the worlds "consensus". Its quite a load of 
inaccurate shit but our effort to rebut it was rejected by wired (I guess 
it wasnt trite enough for them).

-d


On Mon, 15 Jul 1996, Michael Froomkin wrote:

> On Sun, 14 Jul 1996, Timothy C. May wrote:
> 
> > So, who is in this "emerging consensus"?
> > 
> Foreign governments?  
> (Process of elimination, not inside info...)
> 
> 
> 
> A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
> Associate Professor of Law | 
> U. Miami School of Law     | froomkin@law.miami.edu
> P.O. Box 248087            | http://www.law.miami.edu/~froomkin
> Coral Gables, FL 33124 USA | It's hot here.  And humid.
> 
> 
>

Excerpts from internet.cypherpunks: 17-Jul-96 Intl consensus (was Re:
How.. by Dave Banisar@mindvox.com 
> BTW. Those wizards at Wired have gotten our favorite spook Stewart Baker 
> to write an article for an upcome issue talking about how the rest of the 
> world save Japan loves key escrow and those big bad Japanese are 
> thwarting the rest of the worlds "consensus". Its quite a load of 
> inaccurate shit but our effort to rebut it was rejected by wired (I guess 
> it wasnt trite enough for them).

Will anyone else be rebutting it?

-Declan
(not speaking for WIRED, first I heard of this)

Timothy C. May wrote:
> 
> At 12:18 AM 7/15/96, Dave Banisar wrote:
> >Its now up at http://www.epic.org/crypto/key_escrow/wh_cke_796.html

   Thanks to Dave for posting this URL. This is a _very_ important 
document, and I would recommend that all concerned cypherpunks read it 
carefully. Unlike many of its predecessors, it is clearly written and 
quite upfront about the "administration's" goals.

> Thanks. I took an initial look, and it looks like the same old stuff.

   It's not. There's a lot in this document that hadn't been clear to me 
before. I will try to summarize the highlights (these are all my 
interpretations, not actual points made in the document).

1. The battle over whether applications can contain strong encryption 
algorithms has basically been lost. For example, SSL-enabled 
applications are widely available over the world, thanks in large part 
to the work of Eric Young. The same will happen for any other encryption 
protocol that catches on.

2. The battle for key management has not yet been fought. The lack of a 
key management infrastructure is the main reason why people don't use 
PGP widely. This is demonstrated quite clearly by the fact that only a 
few of the people I correspond with, including many premail users, 
actually encrypt messages on a routine basis. If the key management 
stuff were in place, it would "just work."

3. Anybody can write an application that supports strong encryption 
algorithms. Witness SSH, a very impressive and useful program, which was 
basically done by one person, Tatu Ylonen. However, building a key 
management infrastructure will take lots of money, hard work, and 
cooperation.

3a. Consider a future scenario in which a key management infrastructure 
allowed big, unescrowed keys to be distributed widely, but that export 
controls on clients prohibited the use of secure symmetric algorithms. 
Such a situation would not be stable - the incremental cost of 
uncrippled clients would be so small, and so tempting, that they would 
spread like wildfire.

4. Thus, the best leverage for the TLAs to win is to guide the 
development of a key management infrastructure with the following 
property: if you don't register your key, you can't play. I believe that 
this is the true meaning of the word "voluntary:" you're free to make 
the choice not to participate.

5. This is _important_. If you can't get the keys for your 
correspondents, you can't use encryption. If they build a key management 
infrastructure that actually works, people will use it.

6. Export is a two player game. The other country has to allow import of 
the stuff, too. If the Burns bill passes, the "administration" would 
strong-arm other countries to prohibit import of strong crypto, still 
leaving US developers with no market.

7. Building this stuff is too much of a task for the TLAs. They tried it 
with Clipper, and it failed. They hoped that building the Tessera card 
would be enough - that once they threw it over the wall, it would be 
eagerly snapped up by industry.

8. Thus, they're going to cajole, bribe, and coerce software companies 
to play along. This fact is quite nakedly exposed in the document (good 
thing the injunction against the CDA is still in force :-).

[much, much elided from Tim's post]
> ... and by opposition to Clipper I,
> Clipper II, and now Clipper III.

Is this Clipper III or Clipper IV? I seem to have lost count.

> A bunch of Congressmen, including the axis supporting the Burns bill,
> obviously are not part of this emerging consensus.

So it's a "rough consensus" in the spirit of the IETF :-)

> I would push hard on Netscape, Microsoft, Novell, Sun, Apple, and the other
> companies (but mainly on Netscape and MS, for obvious reasons) to bundle in
> "trusted third parties" and all that GAK stuff. Bundle it in, make it easy
> to use, make it easy to export, make it easy to spread in crypto-hostile
> countries, and hope like hell that it undermines the push for PGP and
> S/MIME.

You can count on the fact that NMNSA&c are already being wooed quite 
sweetly.

Don't put too much stock in the push for PGP and S/MIME. Five million 
dollars later, PGP 3.0 is still stuck in the mud. S/MIME has serious 
protocol weaknesses that are still not being addressed. But, most 
importantly, neither of these systems can actually be used on a 
widespread basis, because of the lack of a key management 
infrastructure.

> Don't be fooled.

Who? Us cypherpunks?

Raph

Raph Levien <s_levien@research.att.com> writes:
>4. Thus, the best leverage for the TLAs to win is to guide the 
>development of a key management infrastructure with the following 
>property: if you don't register your key, you can't play. I believe that 
>this is the true meaning of the word "voluntary:" you're free to make 
>the choice not to participate.

>5. This is _important_. If you can't get the keys for your 
>correspondents, you can't use encryption. If they build a key management 
>infrastructure that actually works, people will use it.

There has been some discussion at the last couple of crypto conferences
about possible ways around this plan.  (I guess the idea goes back at
least a year or two.)

One idea is to register a 2048 bit public key.  You have to give the
secret key to the government in order to use the registry.  But what you
do is to create a second key and embed it in the first.  It is, say, a
1024 bit key which is the lower half of the 2048 bit key.  It has
different secret factors that nobody but you knows.  Then when people
send you messages they encrypt using this modulus rather than the
official one.

You get the benefit of the government-sponsored key certificate
infrastructure, but the government is not able to crack your
communications.

The discussion at the crypto conferences has centered on how to design
key systems which don't have this "subliminal key" property, where it is
impossible to create pairs of keys such that publishing one reveals the
other.  I think they were looking at some of the discrete log systems
since in RSA it is pretty easy to do what I have described above.  You
just create the 1024 bit key first, at random, then choose the 2048 bit
key so its modulus matches the 1024 bit key in its low bits.  This is the
same basic method as the so-called "dead beef" attacks against PGP key
ID's which were published earlier this year.

So it will be interesting to see whether any government sponsored PK
infrastructure takes care to avoid subliminal keys.

Hal

At 7:03 AM -0700 7/15/96, Michael Froomkin wrote:
>On Sun, 14 Jul 1996, Timothy C. May wrote:
>
>> So, who is in this "emerging consensus"?
>>
>Foreign governments?
>(Process of elimination, not inside info...)

Perhaps. And the vast inside-the-Beltway policy community, most of whom are
more like Dorothy Denning than Tim May. And the vast business community
that prefers automated escrow in standard systems. What I mean by that is
software or chips automatically escrowed to, say, Price Waterhouse.
Business is comfortable dealing with such firms in a trusted relationship,
and such firms will honor a valid court order to produce records or the
equivalent--a probable cause court-order for a wiretap.

It really depends on how the issue is presented. If it is presented as
preserving law enforcement access, escrow follows. The problem is that like
the nose of the camel, each new piece of legislation establishes a new
status quo baseline of principle from which to argue, and though we all
kicked and screamed about it here, the new baseline is the Digital
Telephony Act.

As for the only counterargument to the above, that bad guys aren't going to
use escrowed systems, nothing is perfect, goes the argument, and the FBI
has caught plenty of bad guys who presumably should have known better, via
wiretaps.

If you look into it, you will find that most people with criminal minds
don't expect to get caught.

Given the nature of this group it perhaps needs saying that the above is a
competitor analysis, not an argument nor my own position on mandatory
domestic key escrow. I'm agin it.

David

At 6:58 AM -0700 7/15/96, Raph Levien wrote:

>2. The battle for key management has not yet been fought. The lack of a
>key management infrastructure is the main reason why people don't use
>PGP widely. This is demonstrated quite clearly by the fact that only a
>few of the people I correspond with, including many premail users,
>actually encrypt messages on a routine basis. If the key management
>stuff were in place, it would "just work."

It is about to be fought. I've got my money not on the government but on
Verisign, which has been issuing site certificates for some time now, and
just started issuing personal certificates which will permit message
encryption using certified, Netscape-generated public keys, among other
things. I think they and the free market will win, over the government,
hands down.

In that context (and in that context only), a lot of the heat from  PGP
fans against heirarchical certification is counter-productive to the above
battle, in that it diffuses the crispness with which successful secure (BBN
boxes, etc.) trusted heirarchical certification authorities will become the
de facto standard and freeze the government out (absent some new draconian
laws).

>
>3. Anybody can write an application that supports strong encryption
>algorithms. Witness SSH, a very impressive and useful program, which was
>basically done by one person, Tatu Ylonen. However, building a key
>management infrastructure will take lots of money, hard work, and
>cooperation.

Verisign and RSA have already made the investment and the mechanism is now
in place and working automatically (except for the higher assurance
certification for which you need to appear before a notary if you're not in
a corporate heirarchy). They've cleverly automated a validation of
moderate-assurance certificate applicants' claims by automatically hitting
the Equifax data base, and the low-assurance (persona) certification is
automated so you need to "just ask". This won't cover everyone, but will
cover so many as to make little difference to widespread acceptance.

>
>3a. Consider a future scenario in which a key management infrastructure
>allowed big, unescrowed keys to be distributed widely, but that export
>controls on clients prohibited the use of secure symmetric algorithms.
>Such a situation would not be stable - the incremental cost of
>uncrippled clients would be so small, and so tempting, that they would
>spread like wildfire.

Depends on the organizations. Big corporations (which carry considerable
influence) aren't going to violate local laws. Thus we may see a "have" and
"have not" escrow-less crypto world outside the US rather than the
hoped-for-nirvana, depending on local laws and individuals' willingness to
violate them.

>
>4. Thus, the best leverage for the TLAs to win is to guide the
>development of a key management infrastructure with the following
>property: if you don't register your key, you can't play. I believe that
>this is the true meaning of the word "voluntary:" you're free to make
>the choice not to participate.

That is exactly what the NRC report recommended and why I opposed it so
vigorously despite its other good features.

>
>5. This is _important_. If you can't get the keys for your
>correspondents, you can't use encryption. If they build a key management
>infrastructure that actually works, people will use it.
>

>6. Export is a two player game. The other country has to allow import of
>the stuff, too. If the Burns bill passes, the "administration" would
>strong-arm other countries to prohibit import of strong crypto, still
>leaving US developers with no market.

We don't have to strong-arm anyone. Harbingers in the UK, the European
Parliament (or is it the Council?), the Netherlands, and the existing
situation in France provide little reason for optimism.

>
>7. Building this stuff is too much of a task for the TLAs. They tried it
>with Clipper, and it failed. They hoped that building the Tessera card
>would be enough - that once they threw it over the wall, it would be
>eagerly snapped up by industry.

Remains to be seen. Netscape has a version they did for the government
which uses Tessera PCMCIA cards. If some big corporation adopts it, others
will follow. Don't count your chickens, etc.

>
>8. Thus, they're going to cajole, bribe, and coerce software companies
>to play along. This fact is quite nakedly exposed in the document (good
>thing the injunction against the CDA is still in force :-).

They don't have to do any of the above. All they have to do is legitimately
contract for their own needs. This will get the costs down (by paying off
the costs of entry/capital costs) so that civilian offerings from the same
technology base could be quite price-attractive. The use of government
market purchasing power to influence events is now very well understood--we
(and Arthur D. Little) first studied it in connection with stimulating
energy conserving buildings back in 1970 when I was in the Department of
Commerce.

> But, most
>importantly, neither of these systems can actually be used on a
>widespread basis, because of the lack of a key management
>infrastructure.

You will find it instructive to check out the Verisign web site, download
the public beta 5 of Netscape 3.0, generate some keys and get some
certificates, and in two or three months check out the promised Netscape
4.0 beta which will have e-mail encryption.

David