My response to NRC crypto study

[Hal <hfinney@shell.portal.com>]

This is a slightly edited version of what I sent:

Thank you for giving members of the public such as myself the
opportunity to discuss our concerns as the NRC studies the National
Cryptography Policy.

I will make my points using the outline of issues dated September 14,
1994 as a reference.


>    * the impact of current and possible future restrictions and standards
>      regarding cryptographic technology on
>    
>        - the availability of such technology to foreign and domestic
>          parties with interests hostile to or competitive with the
>          national security, economic, commercial, and privacy
>          interests of the U.S. government, U.S. industry, and private
>          U.S. citizens;

One traditional method for limiting access by hostile foreign powers to
strategically important technology has been the defense-oriented
classification system.  Important discoveries made by government
researchers have been classified at various levels in order to prevent
their dissemination.  This general approach of secrecy has been applied
as well to the SkipJack algorithm used in the Clipper chip.

However, this approach has not been completely effective with
cryptographic discoveries that are made by private researchers not under
the control of the government.  Probably the most notable event along
these lines was the discovery of public-key encryption technology in the
1970's.  The concept of PK encryption, easy to explain and understand even
for a technologically knowledgeable layman, spread like wildfire despite
some early abortive efforts to suppress it.  This discovery has served as
the foundation for a wide range of research in cryptography and no doubt
is an important reason for the rapid growth of the field over the last twenty
years.

Today, the electronic networks which circle the globe make communication
of new results far easier and more rapid than in the past.  And the
transparency of national borders on the computer networks means that
information, once made available, is available globally.  A discovery
made today comparable to PK encryption in the 1970's would have been far
less likely to be suppressed, and in the future we can expect this tendency
to increase.

Despite this, the US government is currently wielding clumsy policies
which classify all encryption software as munitions and require
complicated licensing procedures for their export.  There is a terrible
mismatch between these policies and the mechanics of information flow
today.  For one thing, the distinction between distribution within the
country and information which flows out of the country is nearly
impossible to make today.  It was always quite unrealistic to suppose
that technology which was widely deployed within the US was unavailable
across our borders, but the information networks make it clear that this
is a fantasy.  As the networks increase in speed, power, and ease of use,
the ties between countries will only grow.  The net will need to be seen
as a global phenomenon, and information on the net will no longer be
localized; made available to one, it is made available to all.

In this environment, the only way to stop information from making its
ways into foreign hands is by keeping it off the net entirely.  And that
implies restricting what kinds of technologies American citizens can
publicly discuss and what kinds of information they can exchange.  If we
want to keep cryptographic secrets, we must prevent people from knowing
or at least talking about those secrets.  This would require Draconian
policies more suitable to a totalitarian state than the world's greatest
democracy.  In short, keeping cryptographic technology secret is
incompatible with American principles.


>        - the competitiveness of U.S. manufacturers of such technology
>          in the international market;
>        
>        - the competitiveness and performance of commercial U.S.
>          users of such technology;

Another problem with the present US policies restricting exports of
cryptographic technologies is their lack of responsiveness to changing
conditions.  Despite the fact that such basic algorithms as the RSA
public-key encryption system or the DES secret-key system are nearly
twenty years old, the government still restricts their export.  This is
ridiculous.  Those algorithms are in use all over the world!  From whom
are we trying to keep them secret?  This is really an illustration of the
well-known inertia and inflexibility of bureaucracies.

The only effect of these bans is to impair the competitiveness of US
business.  Manufacturers of cryptographic technology are not allowed to
export, and users of cryptography are not allowed to use modern
technology if the products might go overseas.  It would be as if the US
were still determined to keep the design of internal combustion engines
secret and so US car manufacturers were forced to use steam because the
cars might be sent across the border.

In the future, as new algorithms are discovered, the same problem will
present itself.  The rapidity and ease of communications ensures that if
the technology is publicly known, it is globally known.  Allowing US
manufacturers to use a technology but not to export it is pointless; if
they know how to use the technology, chances are the rest of the world
does as well.  Restricting exports can only benefit competitors in other
countries at the expense of US businesses.  It is pointless and
counterproductive.


>        - U.S. national security and law enforcement interests;
        
Cryptographic technology has some characteristics which are at odds with
the interests of law enforcement and security agencies.  In a sense,
cryptography is a "purely defensive" technology.  It does not threaten
anyone, it does not invade anyone's privacy, it does not cause damage or
harm.  On the contrary, it protects the user from various kinds of
threats and invasions of his own privacy.  In a way, it levels the
playing field, providing the weak with some of the same protections of
privacy and secrecy which have been traditionally available only to the
strong.

The problem is that law enforcement and security interests have gotten
used to being strong.  It may not have been easy to learn the internal
secrets of a powerful opponent, but eavesdropping on a poor country or
individual was easy.  Indeed, most people have intuitively understood
that they would be nearly powerless if threatened in any significant way
by law enforcement or national security forces.

Now, this may change somewhat.  It remains to be seen to what extent
these changes will occur, and what their full effects will be.  It does
appear that if free access continues to be granted to cryptographic
technology that people will be more immune to certain types of
surveillance.  This does not necessarily mean that the world will
descend into a nightmare of terrorism and war.  It does mean that the
agencies whose job it is to keep order will have to adapt, to learn new
technologies and new approaches.

Naturally, they will resist.  Change is never comfortable, and it is
all too easy to conjure boogeymen out of the unknown.  But before
allowing ourselves to be panicked by the thought of untappable phones
and unreadable mail, we need to consider the alternatives.  Because of
the tremendous ease with which information will flow, only extremely
severe and harsh measures can keep cryptographic technologies out of
the hands of those who want it badly enough.  This has been recognized
from the beginning by the government, as was seen in its flawed Clipper
chip proposal.  The fundamental inconsistency with Clipper was that a
voluntary standard would not be used by criminals, and the restrictions
which would be needed to force criminals to use it would be completely
at odds with American freedoms.  The government's attempt to have it both
ways only sowed fear and mistrust.

It may sound harsh, but it is true: the only way in which cryptography
which can be defeated by law enforcement will come into use is if people
are forced to use it.  And the problem is that people already have
technologies which are too strong for law enforcement to break.  It's too
late to put the genii back into the bottle.  The only choices at this
point are between Big-Brother-style restrictions on use of certain simple
algorithms, or a world in which privacy, unbreakable privacy, is a fact
of life.  Consider carefully whether the latter would be so horrible
before you accept choices which are at odds with our national traditions
of individual freedom.


>    * the strength of various cryptographic technologies known and
>      anticipated that are relevant for commercial and private purposes;

In my opinion, the current suite of cryptographic technologies is well
suited for commercial purposes.  The RSA public-key system has withstood
nearly twenty years of attacks and new algorithms for factoring numbers
(factoring is the problem on which the algorithm is based).  At worst it
may be desirable to raise key sizes from the 512 to 1024 bit level which
are widely used today to perhaps 1024 to 2048 bits, a level which should
provide effectively impenetrable security.  As computers get faster the
larger key sizes can be handled efficiently, while the time to break the
algorithm increases at a much faster rate for larger keys.  The result is
that the passage of time and the increase in computer speeds only helps
the user of RSA rather than the attacker.

RSA is typically used in conjunction with a secret-key cypher for
efficiency, and here DES has been the choice for a number of years.  DES
is now showing its age; its 56-bit key size is beginning to be too small
to give confidence against an attacker.  However, two alternatives are
readily available: triple-DES and IDEA.  Triple-DES has a key length of
112 or 168 bits, depending on the configuration, and IDEA has a key
length of 128 bits.  Both of these are large enough that no conceivable
attack can be launched based on key size alone.  Triple-DES itself has
been cryptanalyzed almost as long as DES, and while IDEA is newer its
security should be much clearer within the next two or three years.  In
addition, there are a number of other conventional cyphers being
developed all the time.  Chances are that one or more of these will be
acceptable as well.  By the turn of the century there should be at least
three or four strong and widely accepted conventional cyphers.

In sum, there is no real commercial need for government involvement in
the development of new cryptographic technologies.  While new
approaches are always welcome, the range of technologies which already
exists is adequate for commercial encryption needs well into the next
century.  Here the best policy for the government is to simply
facilitate the use of these well established systems.


>    * current and anticipated demand for information systems security
>      based on cryptography;

Cryptography is going to be a key technology over the next ten to twenty
years.  There is far more to this technology than simply maintaining
privacy, although certainly in the early years this may be the principle
market area.  But, more generally, cryptography is a technology of
information management.  It allows precise control over how
information is revealed, packaged, and disseminated.  Once recent
discoveries by cryptography researchers are commercialized and made
available to the public there will be whole new areas of business and
commercial interest that are barely imagined today.

Starting with the nearer term, cryptography will be used initially
primarily for privacy and authentication.  As commerce moves onto the
nets, so too will the need for confidentiality.  The insecure nature of
many existing networks will be addressed by layering cryptographic
protocols on top of the existing foundation.  And new networks may be
developed with cryptographic security built in from the beginning.

An important point will be to make the security trustable and transparent.
Trustable means that the end user does not have to trust some third party
not to betray his secrets.  In an increasingly competitive world where
government and corporate espionage are beginning to merge, a system which
tells its users to "trust me" is not going to be competitive with one
which allows users to determine for themselves that their communications
are secure.  This suggests that end-to-end encryption, where the message
is in the clear nowhere on the network, will be the preferred mode.  And
at the same time, the encryption will be transparent, built into the
software used for access to the network, with user-friendly controls and
indicators for the encryption status (and hence reliability) of each
piece of information displayed.  We see the prototypes for these concepts
already with the security extensions to the World Wide Web and its
associated software program, Mosaic.  Similar concepts are being designed
into personal computers as well.

Looking out a bit farther, the next big market for cryptography
technology will be electronic payment systems.  The potential speed and
flexibility of electronic commerce requires an equally fast and flexible
means of electronic payment.  There are many cryptographic technologies
which are suitable, including the electronic equivalent of bank drafts,
checks, cashier's checks, and, perhaps most controversial, digital cash.

It is worth discussing digital cash in a little more detail.  It may well
be that this technology will produce the next Clipper controversy.  The
situation is that digital cash provides for a means of payment which is the
electronic equivalent of cash.  It is private and anonymous.  In an era
when databases of consumer preferences and buying habits may be one of
the major threats to privacy, digital cash will provide protection by
allowing transactions to occur anonymously.  If there is no record of who
participated in the transaction, there is no privacy threat from
databases of such records.

In a sense, this is nothing new, no more threatening than paying a
dollar for bread at the corner grocery store.  But law enforcement
efforts which rely on tracking the flow of funds may be hindered by the
widespread use of digital cash.  This could have implications for money
laundering, income and sales tax collection, and other types of financial
regulations.  As with the prospect of encrypted communications, the
response by law enforcement is likely to be an attempt to block this
technology from coming into widespread use.  And once again the choice
will be between restrictions on what kinds of algorithms people can run
on their computers, and allowing people some privacy in their financial
affairs.

Other cryptographic technologies which are waiting in the wings include
"zero knowledge" proof systems, which allow new forms of
authentication, and which make it possible to prove possession of
certain information without revealing the information itself; secret
sharing systems which allow for true "escrow" of information (unlike
the misnamed government "key escrow" which keeps secrets contrary to
the interests of the user, rather than on his behalf) with very flexible
controls on who can access the information; pseudonym-based credentialing
systems which will allow people to prevent linkage of information about
them in different databases while allowing them to control which
information will be revealed; secret-exchange systems which make it
possible for two people to simultaneously exchange secret information
in such a way that neither can cheat; many forms of digital signatures,
some of which are verifiable only with the cooperation of the signer, but
in such a way that he can't cheat; and a variety of others.  These
technologies will permit wholly new and unforeseeable approaches to
managing and controlling information, and will undoubtedly serve as the
basis for new companies and even new industries.

But these possibilities can only come about if people are allowed to use
them.  Any approach which requires law enforcement review of every new
encryption technology is going to hamstring American companies which want
to innovate and compete in the world.  The tremendous growth and success
of the US software business comes from the free-wheeling competition and
innovation which have characterized it.  Inserting law enforcement
restrictions into the picture can only harm American competitiveness, as
we see already in the cryptographic privacy area.  As we move into the
next century, information itself is going to be a key commodity, and the
monkey wrench thrown into the industrial machine by law enforcement
restrictions on cryptographic and information technologies is going to
have widespread impact.  This is not something we can afford in an
increasingly competitive world.


>    * the impact of foreign restrictions on the use of, importation of, and
>      the market for cryptographic technology;

Narrowly speaking, the interests of the United States are best served
if our foreign competitors are faced with as many disadvantages as
possible.  On this view, foreign restrictions on cryptographic
technology should be welcomed, as they will only harm foreign
companies and make it harder for them to compete with the US.  In the
broader sense, though, the world market is all interconnected.
Inefficiencies and restrictions in one part inevitably harm the smooth
operations of other parts.  It is no longer easy or even possible in
many cases to distinguish activities which are foreign from those
which are domestic.  Regulations which apply to a company's activities
in one country inevitably influence its activities in others.  In this
sense, foreign restrictions on cryptographic technologies will end up
being harmful to US companies and individuals.

In the long run, then, it will be best for the US to work to reduce
foreign restrictions on the use of cryptography.  The prospects of
success are excellent since those countries will be feeling their own
domestic pressures from companies which are being harmed by those
restrictions.  And in an international world a country which stubbornly
maintains obsolete and inefficient restrictions on internal business
activities may simply find itself bypassed, as commerce flows to more
hospitable jurisdictions.

The great danger, and the one to be most carefully avoided, is the
establishment of an international cabal of law enforcement agencies, all
calling for uniform restrictions on encryption applied (as they would
have to be) in all countries on the globe.  This would represent a
pre-emptive strike against individual privacy, the formation of a
de-facto cartel in which governments around the world band together
contrary to the interests of their citizens.  It need hardly be pointed
out how opposed this is to our American principles and traditions.
Furthermore, such an approach is inherently fragile and unstable, as every
country has incentives to advance its own interests by releasing the
shackles which bind its industry.


>    * the extent to which current cryptography policy is adequate for
>      protecting U.S. interests in privacy, public safety, national
>      security, and economic competitiveness;

US cryptography policy has clearly gotten off on the wrong foot.  With
the disastrous Clipper chip proposal, the government has simultaneously
alarmed privacy advocates and demoralized law enforcement.  Today, the
policy is in a shambles, with indications that the government is
withdrawing support for Clipper and searching for other alternatives.

The fact is that current cryptographic technology is perfectly adequate
for privacy protection.  There is no need for government efforts to
introduce new cryptographic systems.  To the extent that Clipper was
presented as a new, improved cryptographic algorithm, it is simply
unnecessary.  Of course, the stated purpose of Clipper was not to improve
privacy, but quite the reverse.  Again, as far as meeting the goals of
privacy protection, the government need only step aside.

Similar considerations hold for economic competitiveness.  Here the
export restrictions on public-domain cryptographic technology are a
ludicrous holdover from the past and serve only to hobble American
companies.  The single best step the government could take today would be
to remove RSA, DES, IDEA, and other international cryptographic standard
algorithms from the list of export controlled technology.

As for the national interest in public safety and security, cryptography
is simply not the threat that it is often painted by law enforcement and
security interests.  With only a few hundred authorized wiretaps a year
on a population of over 200 million people, it is clear that the impact
of secure communications will be only marginal.  Traditional methods of
law enforcement including physical surveillance, infiltration,
informants, and similar approaches have been the foundation of crime
prevention in the past and undoubtedly will be in the future.

Furthermore, attempts to put the cat back in the bag are doomed to
failure.  There are already widespread programs for cryptographic
privacy, and new ones are being written (often by amateurs, so
widespread and simple is the technology) all the time.  The kinds of
regulations which would be required to prevent people from
communicating privately would have to be severe and onerous.  It was
the recognition of this fact which forced the government to back down
from early hints that Clipper might not be a voluntary program.
Citizens of the United States simply will not tolerate the kinds of
government controls that would be necessary in order to return to the
days of free wiretapping.


>    * strengths and weaknesses of current key escrow implementation
>      schemes;

So-called "key escrow", as pointed out by cryptographer Carl Ellison,
is misnamed.  What these systems really provide is Government Access
to Keys, or GAK.  That is the real purpose of these key escrow
systems.  All the discussion about escrow and restrictions on access is
window dressing to obscure the fundamental issue and to make it seem
more palatable.

A true escrow system would be one which held certain information on
behalf of the client.  An escrow agency has well-defined obligations to
the client and to other interested parties.  For example, in a sale of
real property, an escrow agent may hold the cash for the buyer and
pass it to the seller when title has transferred.  There are actually
many legitimate purposes for escrow in the context of information.  One
example would be the purchase of some data package over a computer
network (say, a music video in electronic form).  An escrow agency could
assist with the mutual exchange of payment (perhaps in the form of
digital cash) and the information package in such a way that both parties
are protected against cheating.

In this sense, a true "key escrow" agency might be one with which a
user could deposit his secret key with assurance that it would be held
safely for him.  Then if something happened in the future which caused
him to lose his key, the escrow agency could follow through with its
contractual obligation and return the key to the user.  Or, again with
appropriate authorization, in the event of the user's death or other
circumstances, the agency could reveal the key to the heir or agent of
the original user.  The key point here is that the escrow agency is
providing a service to the user; the user's interaction with the
agency is voluntary.

This kind of key escrow, if offered by the government, would not be
particularly objectionable (although there is no particular reason why this
escrow should be a government, as opposed to private, function).  Just as
the government indirectly backs the banks and provides security to the
depositors, so a government key escrow agency could provide secure
storage of keys (and perhaps other information).

If only this is what the government meant by key escrow!  Actually, of
course, the real purpose of key escrow is to allow the government to
defeat encryption if necessary.  Most of the variations on the existing
schemes involve what mechanisms are used to ensure that the keys are only
revealed under specified conditions.

The Clipper chip proposal has been widely discussed elsewhere.  The
difficulty of ensuring that copies of the keys are not made during the
programming process has been pointed out, as well as the problem that
knowing the family key (or having access to a family key based decryption
unit) allows traffic analysis without needing access to the escrowed
database.  The possibility of rogue units interoperating with Clipper
chips as discovered by Matt Blaze provides a further technical flaw in
this proposal.

A more recent proposal is also worth discussing.  So-called "software
key escrow" (SKE) provides similar functionality to the Clipper chip,
but in software.  A "law enforcement access field" (LEAF) is included in
each message by compliant software as with Clipper.  The main new feature
is that the software on the receiving end can check that the LEAF is
valid without knowing the family key.  This prevents rogue software
from interoperating with compliant software.

Although interesting, this proposal is unlikely to achieve its goals
without the kinds of harsh restrictions discussed above.  The design
goal of making it impossible for rogue software to communicate with
compliant software is really not relevant as that does not solve law
enforcement's problems.  It would be an easy matter to create a rogue
program which communicated compliantly with compliant software and
non-compliantly with rogue software.  This allows the hypothetical
criminal to communicate with his cohorts privately while communicating
freely with everyone else.  Again, the only way this system or any
similar key escrow system can succeed is if people are forbidden to use
anything else.


>    * how technology now and in the future can affect the feasible policy
>      options for balancing the national security and law enforcement
>      interests of government and the privacy and commercial interests
>      of U.S. industry and private U.S. citizens;

To the extent that this debate is expressed as a conflict between
government and citizens, it is already clear what has gone wrong.  There
should not be a conflict between government and its citizenry, not in a
democracy.  The citizens rule the government in the American system, not
the other way around.

What has happened here is that certain agencies within the government
seem to have forgotten this fundamental fact.  They see the people of the
United States as, if not their enemies, then at least their potential
enemies.  Law enforcement and national security agencies have become so
accustomed to wielding immense power that they cannot tolerate the
thought of giving up some of it.  Thus we have their desperate attempt to
turn back the clock, to freeze technology at a 1970's level, to prevent
people from using the cryptographic tools which are becoming more
widespread every day.

There is no need to balance the interests of the US government and
private citizens.  The only interests which are relevant are those of the
citizens.  What needs to be balanced are those citizens' interests in
public safety and their desire for privacy and freedom.

This conflict is nothing new.  It has always been true that there is a
tradeoff between security and freedom.  Different countries all around
the world have chosen to balance this tradeoff at different points.  At
one extreme we have totalitarian states where security is everything and
individual freedom is nearly gone.  The example of Singapore is widely
used today as a place where the citizens have, largely voluntarily, given
up a great deal of individual privacy and freedom in exchange for a
tightly regulated, but peaceful, society.

We in the US have traditionally chosen a different, and historically
superior, approach.  Our national traditions emphasize the importance
of the individual.  All through American history the lessons we have
learned have taught us to respect individual freedoms at the expense of
government regulations and controls.  This has been one of the
fundamental principles which has led to our tremendous success.

In the context of the encryption debate, then, the default position
should and must be one of individual freedom.  We already allow
individuals to use any encryption technology they desire.  Any proposal
to move from this principle, a principle which is firmly in accord with
American traditions, should be viewed with the utmost caution.

And, as the above discussion has emphasized, there is really no legitimate
policy position which moves us only slightly in the direction of greater
control.  The choice is not between privacy and a little bit of
regulation.  It is between privacy and very invasive, very intrusive
restrictions.  The nature of cryptographic technology is such that it is
so easy to use that only an intensive effort can prevent its use, or
force the use of a government-approved alternative.  The policy decision
is really between one which maintains American traditions of freedom and
one which takes a drastic step towards government control.

In the future, this situation will only become worse from the point of
view of those opposed to communications privacy.  As more countries
become computerized, as the global networks spread further, as more
people learn how easy it is to ensure their own privacy, it will be all
the harder to keep people's communications under government-approved
systems.  Technology sounds the death knell for traditional ways of
approaching the law enforcement and national security business.  The
longer governments are allowed to ignore that fact the more likely it will
be that the totalitarian solution will be imposed.


>    * recommendations for the process through which national security,
>      law enforcement, commercial, and privacy interests are balanced
>      in the formulation of national cryptography policy.


The traditional way to balance the competing interests would be to put
national security and law enforcement people, business people, and a
few "privacy advocates" on a committee, then let them make
recommendations to the Executive or Legislative branches of
government.  Although this may be appropriate for the initial
evaluation of the situation, it has serious problems.  It puts far too
much weight on the specific interests of security and law enforcement.
Although these are legitimate duties of government, they are not its
only duties, and they certainly do not override the traditional
American emphasis on individual liberty.

In the next century, the primary economic fact will be international
competition.  In a global world, there is no longer any place for
pointless government regulations which will interfere with the success
of domestic business or cause commerce and capital to flee to other
countries.  Attempting to mollify outdated law enforcement concerns by
restricting the use of encryption technologies will only hurt American
citizens.

The fact is that, given these economic realities, the only policy
decision which makes sense is one which encourages, rather than
restricts, the use of encryption.  Government should relax export
controls, retire its key escrow proposals, reveal the SkipJack
algorithm used in Clipper, and turn its researchers to the task of
helping American competitiveness rather than thinking up new ways of
hindering US businesses.

The only "process" that is needed is the political courage to overcome
the objections of law enforcement and force them to concentrate on the
job at hand, stopping criminals, rather than working on new ways to
block encryption technology.  It doesn't have to be done right away.
It will take years for encryption to work its way into the economy.  We
probably won't see widespread encryption of telephone and other
electronic communications for five or even ten years.  This time must
be used productively by law enforcement to design new strategies to
meet the challenges ahead.  If the government wastes time on an
ultimately doomed campaign to try to freeze technology and restrict
encryption then we will all ultimately be the losers.

Thank you again for your attention.


Hal Finney
email: hfinney@shell.portal.com