Blanc Weber writes:
What would you say is the critical, key focal point between the existence of a system of operation, and the way it is intended to be used?
And how would you get the educational message out to those involved?
I know I've written too much today--I'll try to take a few days off once SKE thing blows over (blows over for _now_, since it is likely to be with us for years). But Blanc asks a concrete question that actually has a very simple answer. First, the nature of the TIS-developed SKE system needs to be further examined. But from my recollection of what Diffie told us about it, and what Matt Blaze has told us about it, the most dangerous aspect of a government-friendly SKE system is that government(s) will license, authorize, regulate, or control escrow agents. That is, entities that are "escrow agents" might have to pay a $500 yearly fee (like gun dealers), meet certain requirements, file paperwork, be subject to audits of records, etc. In fact, this sort of thing seems consistent with what foreign governments are almost certain to require of SKE. Here's the catch: a purely voluntary system, such as Joe's Accounting or Cypherpunks 'R Us might want to use would allow several easily-selectable options: - no escrow at all....flip a switch, and escrow is bypassed completely (after all, if "key escrow" is purely voluntary, and is driven by customer demands, then the default option would be "no escrow") - escrow sites can be arbitrary (or even dev/null bit buckets) (again, if driven by customer demands, no licensing, no regulation, etc. Escrow sites could just be disk drives on the LAN, for example.) So the answer to Blanc's question is clear:
What would you say is the critical, key focal point between the existence of a system of operation, and the way it is intended to be used?
Answer: A voluntary escrow system shall have no requirements that it must be used, no limitation on the nature or form of the escrow sites, and no requirements whatsover for licensing, auditing, regulations, inspection, or control of escrow sites. Escrow sites could be one's mother, one's neighbor, or even one's own system. Or none at all. And no SKE system should communicate to others, in special fields or elsewhere, whether escrow is being used, who or what the escrow sites are, etc. (Again, a truly voluntary system should not have any such hooks in it. When I make backups of my data, I don't have to signal to the outside world what format, where, etc. Key escrow for added security should be "observationally inivsible." No party outside the individual or group using key escrow should have any way of knowing if key escrow is occurring. Simple. Any requirements imposed by negotiation with law enforcement, the FBI, Interpol, the NSA/NIST, or any other body signal that the so-called "voluntary" standard is about as voluntary as income taxes are. And *any* signalling that escrow is or is not being done is a violation of the observational invisibility criterion for a voluntary system. So, the answer is very simple: a truly customer-driven solution will have many ways of turning off the escrow, choosing agents arbitrarily and without permission from outsiders, and with "observational invisibility" that makes the choice of using key escrow truly a private choice. (I submit that this will not be very acceptable to law enforcement, which is of course why the "voluntary" nature is a charade.) We can make a more refined list of essential characteristics of a truly voluntary system, as I may have missed a few details. But the idea is common-sensical: a voluntary system is a private system, giving no evidence as to its use, nonuse, conditions, etc. These are features of Microsoft's or anyone else's SKE system that we can verify easily. And report any deviations from. Once again I urge the folks out there working on SKE systems--and I know at least 3 by name now, not to sound like Senator McCarthy--to openly discuss these points and to publically commit to a "voluntary escrow" protocol that has strong crypto/no escrow as a central option. (If the only choices are strong crypto/mandatory escrow and weak crypto/no escrow, then we know the standard is hardly voluntary.) I thank Blanc for asking such a direct question, one which has an easy answer. I hope she can pass it on to others. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."