Registering Keys...

[Hal <74076.1041@CompuServe.COM>]

This proposal to register keys was also mentioned in the July, 1992
Communications of the ACM, in an article by Ron Rivest, one of the
creators of the RSA algorithm.  He was mostly criticizing the proposed
government Digital Signature Standard, stating that he thought that
the NSA was purposely trying to get "weak" cryptography installed as
the standard.  Then he goes on to say,

"Are there technical alternatives that would satisfy all parties?
Perhaps.  It is certainly the case that the formulation of the problem
to be solved has never been made explicit for the cryptographic
community to work on.  I suspect that a solution based on 'escrowed
secret keys' might be workable, wherein each user is legally required
to depost his or her secret key with a trusted third party, such as
the user's bank.  Cryptographic hardware and software would only
operate with public keys that were certified to having their corres-
ponding secret keys appropriately escrowed.  A federal agency could
then obtain the secret key, or its use, with an appropriate warrant.
Once their secret keys were escrowed, multinational corporations could
even operate across borders with a high degree of authentication and
privacy (except perhaps from court-ordered wiretaps).  Cryptographic
hardware and software manufactured in the U.S. would not operate
abroad without public keys suitably certified as having their secret
counterparts escrowed in the U.S.  In an extension of this approach,
users can escrow their secret keys with several trusted third parties
in a 'secret-sharing' manner, so that no single third party can com-
promise the user's key.  While this approach may have its own difficulties,
it does illustrate that weak cryptography is not the only technical
approach available.  There may be much better techniques for achieving
a compromise between a number of conflicting national concerns."

At the time that I read this, I thought it was largely a rhetorical
device, making the point that if the government wants to infringe on
people's privacy, it should come out in the open and do so, rather
than skulking about.  (Like saying, "if the government _really_ wants
to stop sexual immorality it would have to put a TV camera in every
bedroom".) And of course (I thought) this kind of proposal would never
be taken seriously.  I'm shocked that Denning is now advocating it openly.

This proposal makes it illegal for people to communicate so secretly
that the government can't find out what they are saying.  It could
apply to postal mail as well as email - it would be illegal to send
a message via post which the government couldn't interpret.  If this
is really the government's purpose, then it should also require that all
private conversations be recorded, and the resulting tapes be "escrowed"
similarly in case the government needed to find out what was said,
for which it would have to get a court order.

As Tim suggested, this is probably a "trial balloon" being floated to
see what the reaction is.  Let's see that it gets shot down.

Hal
74076.1041@compuserve.com