Re: Full text of David Chaum's Congressional speech

[fc@all.net (Dr. Frederick B. Cohen)]

A few minor comments on David Chaum's testimony before congress:

...
> As an American who is regarded as the inventor of electronic cash,
> who has worked over the last dozen or so years to make the technology
> viable, and who is now CEO of a leading company pioneering in its
> commercialization, I am very pleased by the interest being shown
> here and to be here today. 

The inventor of electronic cash is Mr.  William S.  Powell, who holds
the patent on the electronic cashwatch and whose patent has been stomped
on by numerous and various others because he doesn't have the money to
defend it.  David Chaum's published work was more than 7 years later
than the issue date of the Powell patent.

...
> it will be the responsibility of government to protect against
> systemic risk.  This is a serious role that cannot be left to the
> micro-economic interests of commercial organizations.

David's technology notwithstanding, the only way the government can do
this is by eliminating the anonymity associated with cash in favor of a
fully audited system in which all of the transactions are known to the
government.  This is fundamentally at odds with the goal of privacy. 

> In order for those in government to make informed decisions, it will
> be necessary for them to understand the basic ways to secure
> transactions in different situations.

It is unlikely that their decisions will be based on their understanding
of technology - it better not be, since they don't understand it. 

> One basic form is tamper-resistance, exemplified by the chip in a
> chip card.  It is designed to be hard to modify or to read secrets
> from. Such tamper-resistance is needed for "off-line"
> payments--those in which the reader device receiving payment from a
> card, validates payments by contacting a central system only at the
> end of each day.

The current technology costs about $500 per chip-card to read and
recreate.  No current purely electronic technology is capable of being
used for a larger value than that under any scheme feasible for
electronic money.

> (Incidentally, this and the other basic form must rely for security
> on cryptography, sometimes refereed to as encryption, which is
> fundamental to all information security.) 

This is not true.  The vast majority of effective current technology in
information security is not tied to cryptography.

...

The testimony goes on and on, but I'll give up here for now.

---
-> See:  Info-Sec Heaven using our New Super Secure World-Wide-Web Server
-> Free: Test your system's security (scans deeper than SATAN or ISS!)
---------------------- both at URL: http://all.net ----------------------
-> Read: "Protection and Security on the Information Superhighway"
	 John Wiley and Sons, 1995 ISBN 0-471-11389-1, 320 pp, $24.95
-------------------------------------------------------------------------
   Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236