Re: access to storage keys, NOT comms keys!

[Anonymous <nobody@REPLAY.COM>]

Here is what leading cryptographers say about email key recovery, from
http://www.crypto.com/key_study/report.shtml.  This includes respected
figures like Bruce Schneier, Matt Blaze, Ron Rivest, Ross Anderson,
Whit Diffie, and more.

   2.1 Communication Traffic vs. Stored Data
   
   While key ``recoverability'' is a potentially important added-value
   feature in certain stored data systems, in other applications of
   cryptography there is little or no user demand for this feature. In
   particular, there is hardly ever a reason for an encryption user to want
   to recover the key used to protect a communication session such as a
   telephone call, FAX transmission, or Internet link. If such a key is lost,
   corrupted, or otherwise becomes unavailable, the problem can be detected
   immediately and a new key negotiated. There is also no reason to trust
   another party with such a key. Key recoverability, to the extent it has
   a private-sector application at all, is useful only for the keys used
   to protect irreproducible stored data. There is basically no business
   model for other uses, as discussed below.
   
   In stored data applications, key recovery is only one of a number of
   options for assuring the continued availability of business-critical
   information. These options include sharing the knowledge of keys
   among several individuals (possibly using secret-sharing techniques),
   obtaining keys from a local key registry that maintains backup copies,
   careful backup management of the plaintext of stored encrypted data, or,
   of course, some kind of key recovery mechanism. The best option among
   these choices depends on the particular application and user.
   
   Encrypted electronic mail is an interesting special case, in that it
   has the characteristics of both communication and storage. Whether key
   recovery is useful to the user of a secure E-mail system depends on
   design of the particular system.
   
   The government, on the other hand, proposes a key recovery infrastructure
   that applies to virtually all cryptographic keys, including (especially)
   those used to protect communications sessions.

They say that key recovery is not appropriate for transient keys used
during a communication session.  However, email is a special case, having
characteristics of both communication and storage.  In some systems,
email may be archived for long periods of time in the same format that
it was received.  For such systems there is a business case for key
recovery in email.