["Vinton G. Cerf": Letter to Congress/RSA + DES]

[Marc Horowitz <marc@GZA.COM>]

Vint Cerf is a very well-known and respected person in the Internet
community.  I don't know if his testimony will mean anything, but it's
interesting to read.

		Marc

------- Forwarded Message

To: internauts:;@IETF.CNRI.Reston.VA.US
Subject: Letter to Congress/RSA + DES
Date: Tue, 13 Apr 93 20:26:01 -0400
Sender: cclark@IETF.CNRI.Reston.VA.US
From: "Vinton G. Cerf" <vcerf@CNRI.Reston.VA.US>




Dr. Vinton G. Cerf
3614 Camelot Drive
Annandale, VA 22003-1302

11 April 1993
The Honorable Timothy Valentine
Committee on Science, Space and Technology
Subcommittee on Technology, Environment and Aviation
House of Representatives
Rayburn House Office Building

Dear Chairman Valentine:

I recently had the honor of testifying before the 
Subcommittee on Technology, Environment and Aviation 
during which time Representative Rohrabacher (R, 
California) made the request that I prepare 
correspondence to the committee concerning the 
present US policy on the export of hardware and 
software implementing the Data Encryption Standard 
(DES) and the RSA Public Key encryption algorithm 
(RSA).

As you know, the DES was developed by the National 
Institute for Standards and Technology (NIST) in the 
mid-1970s, based on technology developed by 
Internatonal Business Machines (IBM). The details of 
the algorithm were made widely available to the 
public and considerable opportunity for public 
comment on the technology was offered. In the same 
general time period, two researchers at Stanford 
University (Martin Hellman and Whitfield Diffie) 
published a paper describing the possible existence 
of mathematical functions which, unlike the 
symmetric DES algorithm, could act in a special, 
pairwise fashion to support encryption and 
decryption. These so-called "public key algorithms" 
had the unusual property that one function would 
encrypt and the other decrypt -- differing from the 
symmetric DES in which a single function performs 
both operations. The public key system uses a pair 
of keys, one held private and the other made public. 
DES uses one key which is kept secret by all parties 
using it.

Three researchers at MIT (Rivest, Shamir and 
Adelman) discovered an algorithm which met Hellman 
and Diffie's criteria. This algorithm is now called 
"RSA" in reference to its inventors. The RSA 
technology was patented by Stanford and MIT and a 
company, Public Key Partners (PKP), created to 
manage licensing of the RSA technology. A company 
called RSA Data Security, Inc., was also formed, 
which licensed the technology from PKP and markets 
products to the public based on the technology.

The current policy of the United States places DES 
and RSA technology under export control. Because 
cryptography falls into the category of munitions, 
it is controlled not only by the Commerce Department 
but also by the State Department under the terms of 
the International Traffic in Arms regulations. 
Despite the public development of both of these 
technologies and their documented availability 
outside the United States over the last 15 years, US 
policy has been uniformly restrictive concerning 
export licensing. 

As the United States and the rest of the world enter 
more fully into the Information Age in which digital 
communications plays a critical role in the global 
infrastructure, the "digital signature" capability 
of public key cryptography is a critical necessity 
for validating business transactions and for 
identifying ownership of intellectual property 
expressed in digital electronic forms.

Registration and transfer of intellectual property 
rights in works which can be represented in digital 
form will be cenral factors in the national and 
global information infrastructure. A number of 
parties are exploring technical means for carrying 
out rights registration and transfer, making use of 
public key cryptography as a basic tool. 

In addition, there is a great deal of current work 
on electronic mail systems which support privacy by 
means of encryption and support authenticity by 
means of digital signatures. One of these systems, 
developed in the Internet environment I mentioned in 
my testimony, is called Privacy-enhanced Mail (PEM) 
and makes use of DES, RSA and some other special 
"hash" functions which are integral to the 
production of digital signatures.

For these various systems to be compatible on an 
international basis, it would be very helpful for 
the cryptographic components to be exportable on a 
world-wide basis. A number of vendors make produces 
relying on these technologies within the United 
States but often find it very difficult to engage in 
international commerce owing to the export licensing 
required for these technologies. Ironically, the 
technology appears to be widely available outside 
the US and also outside the COCOM countries, so US 
firms face both competition outside the US and 
export inhibitions in their attempts to develop 
worldwide markets.

There are  many valid national security reasons for 
limiting the export of cryptographic capabilities, 
since these technologies may aid an opponent in time 
of war or other conflict. Perhaps just as important, 
US intelligence gathering capability can be eroded 
by the availability of high grade cryptography on a 
worldwide basis. Recently, it has also been alleged 
that the world-wide availability of cryptography 
would also seriously impede US drug enforcement and 
anti-crime efforts. While these reasons seem 
sufficient, many have pointed out that the 
widespread accessibility to the detailed 
specifications of DES and RSA and availability and 
existence of software and hardware outside the US 
have long since done whatever damage is going to be 
done in respect of warfighting, crime or drug 
potential. This line of reasoning leads to the 
conclusion that our policies only inhibit legitimate 
commerce, but have little impact on the other 
concerns expressed.

As in all such controversy, there is often some 
truth on both sides. The National Institutes of 
Standards and Technology (NIST), has offered 
alternative digital signature capability. Technical 
assessments of the alternative have turned up 
weaknesses, in the opinions of some experts. There 
is not yet an alternative to DES, unless it is to be 
found in NSA's Commercial Crypto Evaluation Program 
(CCEP) in which NSA proposes to provide algorithms 
which are implemented in hardware by industry and 
made available for civilian use. As I understand 
this program, NSA does not intend to release any 
details of the algorithms, leaving open questions 
about the nature and strength of the technology. 
Some experts will persist in the belief that such 
offerings have weaknesses which are deliberately 
built in and hidden (so-called "Trojan Horses") 
which will allow the agency to "break" any messages 
protected by this means.

The critics complained loudly that the reasoning 
behind the design of certain parts of the DES 
algorithm (specifically the "S-boxes") was never 
made public and therefore that the algorithm was 
suspect. In fact, the DES has proven to be very 
strong - indeed, it may be that very fact which 
makes it so unpalatable in some quarters to permit 
its unrestricted export. It may be that the CCEP 
technology offered is satisfactory, but this is hard 
to tell without knowing more about its provenance. 

Presuming the wide availability of both DES and RSA 
technology, it seems to me appropriate and timely to 
re-examine US export control policy regarding these 
two algorithms. In all probability, any such review 
will require some classified testimony which will 
have to be heard in confidence by cleared members of 
your committee. I sincerely hope that the outcome 
will be favorable to use by US industry in 
international commerce, but even if the outcome 
results in continuation of present policy, it is 
timely to make such a review, in my opinion.

Sincerely,


Vinton G. Cerf






------- End of Forwarded Message