White House crypto proposal -- too little, too late

---------- Forwarded message ----------
Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT)
From: Declan McCullagh <declan@well.com>
To: fight-censorship@vorlon.mit.edu
Subject: White House crypto proposal -- too little, too late

I just got back from the White House, where Gore's office held a
roundtable plugging the administration's long-awaited and already
widely-derided Return of Clipper proposal.

Gore announced that jurisdiction over crypto exports would move to the
Commerce Dept; that the export embargo on 56-bit DES would be lifted
in part for two years only; that to be approved for export firms must
submit a detailed proposal describing how they will move towards key
escrow; that the new regulations would go into effect on January 1.

The true problem with this plan is that 56-bit DES is woefully
inadequate.  But much of the media coverage I've read of the plan
doesn't even mention that. Take Elizabeth Corcoran's article, which
ran above the fold on the front page in today's Washington Post. (It's
what almost certainly prompted Gore's office to move the announcement
to today rather than hold it later this week.)

The thrust of the article is that the administration's new proposal
balances the needs of privacy, business, and law enforcement. But it
doesn't. The Feds, foreign governments, and determined attackers can
crack anything encrypted with 56-bit DES -- the strongest crypto that
can be exported under the plan. This vital fact appears nowhere in the
Post article.

That's why Bruce Schneier, author of Applied Cryptography, recommends
against using DES in favor of a more secure algorithm. According to
Schneier: "A brute-force DES-cracking machine [designed by Michael
Wiener] that can find a key in an average of 3.5 hours cost only $1
million in 1993."

More recently, in January 1996 an ad hoc group of renowned
cryptographers including Matt Blaze, Whitfield Diffie, Ronald Rivest
and Schneier, released a report going even further. They said: "To
provide adequate protection against the most serious threats -
well-funded commercial enterprises or government intelligence agencies
- keys used to protect data today should be at least 75 bits long. To
protect information adequately for the next 20 years in the face of
expected advances in computing power, keys in newly-deployed systems
should be at least 90 bits long."

What's even more disturbing is what the administration might do
next. After the roundtable broke up, I chatted with Michael Vadis, one
of the assistant deputy attorneys general who oversees national
security issues. He said an international consensus is forming that
terrorists can use crypto; therefore crypto must be controlled. The
U.S. is certainly pushing this line at the OECD talks.

"But it just takes one country to decide to export strong crypto," I said.

"You're missing something," said Vadis.

"What?" I asked. "Unless you're talking about import restrictions."

"Exactly," he said.

-Declan

*******

Some background:

   Linkname: Brock Meeks on White House plan -- 6 Sep 96
   Filename: http://www.muckraker.com/muckraker/96/36/index4a.html

********

http://www.washingtonpost.com/wp-srv/WPlate/1996-10/01/041L-100196-idx.html

U.S. TO EASE ENCRYPTION RESTRICTIONS

Privacy Advocates Wary of Proposal For Software Exports

   By Elizabeth Corcoran
   Washington Post Staff Writer
   Tuesday, October 1 1996; Page A01
   The Washington Post

   The Clinton administration is cutting off an emotional four-year-old
   debate with the computer industry over the export of
   information-scrambling technology with a plan that it says will help
   U.S. companies boost sales overseas and still allow law enforcement
   agencies to unscramble messages, officials said yesterday.

   President Clinton has decided to sign an executive order that changes
   the rules restricting the overseas sale of the technology, the
   officials said. Although the full details of the plan had yet to be
   revealed, privacy advocates and some industry executives contended
   that it would be difficult to put into practice.

   Under current rules, companies can sell only relatively easy-to-crack
   scrambling technology. Under the plan, they would get permission to
   export somewhat more sophisticated versions of the software and
   hardware, which prevents eavesdroppers from looking at information.

   The issue has caused enormous friction between the government and
   computer industry and privacy groups, which contend that keeping any
   restrictions in place will harm the protection of personal information
   everywhere and slow the development of on-line commerce, which relies
   on keeping credit card numbers and other sensitive information secure.

   The administration counters that it has come a long way in meeting
   such objections. However, last night some companies and privacy
   advocates were still worried that the constraints will leave U.S.
   companies at a disadvantage abroad and will not ensure that
   individuals will be able to protect their communications.

   The government's plan preserves what has been its unnegotiable
   cornerstone since the debate began in the early day of the Clinton
   administration -- that law enforcement officials must have the means
   for peeking at encrypted information when they are properly equipped
   with court authorization.

   Earlier versions of the plan tightly limited what kinds of technology
   could be sold abroad. They also called for makers of encryption
   technology to deposit "keys" with approved third parties so that law
   enforcement authorities could decode material. The new plan doesn't
   specify who would have the keys.

   Last night, several companies, led by International Business Machines
   Corp., said they have a technical plan that they believe could comply
   with the new rules on keys.

[...]
   
   Industry officials say they ultimately want to be able to use the most
   sophisticated encryption technology available. "It's really critical
   to doing business around the world," said an IBM source. "But
   governments exist. It's a balancing act . . . to satisfy the needs of
   the governments and make sure that markets and individuals trust the 
   integrity of what's being sent over the networks."             

[...]

Declan wrote:
>I just got back from the White House, where Gore's office held a
>roundtable plugging the administration's long-awaited and already
>widely-derided Return of Clipper proposal.
>
>Gore announced that jurisdiction over crypto exports would move to the
>Commerce Dept; that the export embargo on 56-bit DES would be lifted
>in part for two years only; that to be approved for export firms must
>submit a detailed proposal describing how they will move towards key
>escrow; that the new regulations would go into effect on January 1.
>
Although I didn't change the title of this thread, I must disagree.

This is a brilliant move by the government.

They hold a (small) carrot out to industry:
	You can export marginally stronger crypto for 2 years, _if_ you develop a 'key recovery' system. 

At the end of the two years, they tell computer companies:
	Either you implement your system, or you stop exporting your products.
	If we don't like the system that you come up with, we won't approve it; and you can't export your (by then) existing products any more.


The computer industry has to pay the costs for developing this system, _and_, since they developed it, it is really hard for them to complain about the details of it.

Somebody in Washington has a lot on the ball.

And lots of people are falling for it:
    Apple, Atalla, DEC, Groupe Bull, HP, IBM, NCR, RSA, Sun, TIS, and UPS, to name a few.


-- Marshall

Marshall Clow     Aladdin Systems   <mailto:mclow@mailhost2.csusm.edu>

"We're not gonna take it/Never did and never will
We're not gonna take it/Gonna break it, gonna shake it,
let's forget it better still" -- The Who, "Tommy"

On Sun, 6 Oct 1996, Marshall Clow wrote:

> This is a brilliant move by the government.
> 
> They hold a (small) carrot out to industry:
> 	You can export marginally stronger crypto for 2 years, _if_ you develop a 'key recovery' system. 
> 
> At the end of the two years, they tell computer companies:
> 	Either you implement your system, or you stop exporting your products.
> 	If we don't like the system that you come up with, we won't approve it; and you can't export your (by then) existing products any more.
> 
> 
> The computer industry has to pay the costs for developing this system, _and_, since they developed it, it is really hard for them to complain about the details of it.
> 
> Somebody in Washington has a lot on the ball.

Much of this is Gorelick and her fledglings doings.

> -- Marshall
> 
> Marshall Clow     Aladdin Systems   <mailto:mclow@mailhost2.csusm.edu>
> 

--
I hate lightning - finger for public key - Vote Monarchist
unicorn@schloss.li

> Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT)
> From: Declan McCullagh <declan@well.com>
> 
> "What?" I asked. "Unless you're talking about import restrictions."
> 
> "Exactly," he said.
> 
> -Declan

I don't doubt that they can do this if they really want to, but I
wonder what legal basis they will use for import restrictions.

Are there any current import restrictions for products on can legally
manufacture, sell, and use in the United States?

Thanks.

> 
> > Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT)
> > From: Declan McCullagh <declan@well.com>
> > 
> > "What?" I asked. "Unless you're talking about import restrictions."
> > 
> > "Exactly," he said.
> > 
> > -Declan
> 
> I don't doubt that they can do this if they really want to, but I
> wonder what legal basis they will use for import restrictions.
> 
> Are there any current import restrictions for products on can legally
> manufacture, sell, and use in the United States?

As of now, there are no restrictions on importation and utilization of any
crypto in the United States.  However, if certain people have their way,
this will change quickly.

On Tue, 1 Oct 1996, John Anonymous MacDonald wrote:

> > From: Declan McCullagh <declan@well.com>
> > 
> > "What?" I asked. "Unless you're talking about import restrictions."
> > 
> > "Exactly," he said.
> > 
> > -Declan
> 
> I don't doubt that they can do this if they really want to, but I
> wonder what legal basis they will use for import restrictions.

Public safety.

> Are there any current import restrictions for products on can legally
> manufacture, sell, and use in the United States?

Sure. Firearms. The Gun Control Act of 1968 bans the importation of 
supposedly "cheap" firearms that can to this day (though this is about 
to change) legally be manufacturered and sold in the US. For the political 
novices, here is a brief explanation of the often overlooked 
cryptography/"munitions" connection.

A high level of firearms ownership in the population, similarly to a high 
penetration of crypto software, puts an upper boundary on what a 
government can do to its citizens. The first order of any government 
wishing to go beyond this border must therefore be to dramatically reduce 
the level of gun ownership (and crypto, but that is relatively new 
invention.)

Consequently, one of the first laws the Fuhrer had passed was the Firearms 
Control Act of 1933. The USG, also intend on exceeding said boundary (to 
what degree remains to be seen) followed his lead in passing the Gun 
Control Act of 1968, copying much of the 1933 law, often verbatim. This 
should come as no surprise, given the fact that the author of the 1968 
Act was working of a translation of the 1933 law that he requested from 
the Library of Congress.

Once the concept of gun control had been established, it could be 
expanded on in the future and has been so to this day.

What does all that have to do with crypto? It is the *same* issue. In the 
government's view, crypto is a danger to their future plans, just as 
firearms are. Do you think it is a coincidence that crypto is listed as a 
munition? Think about it for just a moment. Crypto is a weapon in the 
hands of the people. And that's what Cypherpunks is all about.

Starting from import restrictions, you will see restrictions on size of 
keys (=maximum rounds in the magazine, now set at 10, proposed to be 
lowered to six), who may own it (no felons, people convicted of certain 
misdemeanors), who may sell it and how it can be purchased (must provide 
identification, sales will be logged). I guess you can figure out the rest.

--Lucky

> I don't doubt that they can do this if they really want to, but I
> wonder what legal basis they will use for import restrictions.
> 
> Are there any current import restrictions for products on can legally
> manufacture, sell, and use in the United States?

While I'd wager that this would be a violation of GATT's competition
clause, since it would favor domestic firms over foreign ones, there is a
loophole in GATT for national security that could be invoked.

Ben.
____
Ben Samman.................................................ben@edelweb.fr
Paris, France                      Illudium Q36 Explosive Space Modulator

At 8:50 PM -0700 10/1/96, John Anonymous MacDonald wrote:

>I don't doubt that they can do this if they really want to, but I
>wonder what legal basis they will use for import restrictions.
>
>Are there any current import restrictions for products on can legally
>manufacture, sell, and use in the United States?

Automobiles, computers, chips, steel, tobacco, televisions....

All have had, or still have, various "import restrictions." Sometimes
quotas, sometimes heavy duties, sometimes complete bans. Sometimes the
rationale was that foreign nations were "dumping," but often the real
rationale was protectionism.

(This may not have been the type of example the questioner was asking
about, but it fits the definition of "import restrictions." In fact, the
whole raison d'etre of "U.S. Customs" is to control imports as well as
exports, and certainly not just "illegal imports.")

There are also various animals which may not be imported, various
agricultural products which may not, etc., even if the animals and
agricultural products may be found in the U.S. (Examples: various reptiles,
tropical birds, endangered species, etc.)

--Tim May



We got computers, we're tapping phone lines, I know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1,257,787-1 | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."