I've enjoyed Peter Hendrickson's provocative postings and the many good responses. However I don't think we should forget that the FBI and other law enforcement agencies almost certainly do hope to ban strong encryption in the U.S. and in other countries as well. So it is worth discussing how the ban is likely to happen and what impact, if any, it would have. I could see such a measure going into effect after the next terrorist attack as part of a comprehensive bill that also includes taggants in explosives, more permission for wiretaps and surveillance of terrorists, and similar items on the LEA laundry list. Keep in mind the effects of the current ban on U.S. exports of crypto technology. Obviously this have not stopped crypto from moving overseas. But it has definitely had significant effects. It is _not_ widely ignored, at least in public. That is why we work so hard to overturn it; if it had no effect, we wouldn't care. Companies are much more careful about how and whether they will distribute crypto on the net; for many months Netscape's free software didn't have strong crypto; Americans even on this list are afraid to publish algorithms and envy Adam Back's freedom to do so. My guess about how a crypto ban would go is that it would be an extension of the export ban, and be based on interstate commerce regulation. It would ban distribution of crypto software, commercial, freeware, and shareware, which had the ability to hide the content of messages. Exceptions would exist along the lines of the recent export proposals, where the software would be OK to use if it had a small key size with an approved cipher, or other means to ensure law enforcement access. The ban might also cover stego and stealth type software, at least if that were the primary purpose of such programs. The U.S. would also work to convince foreign countries to implement similar bans. One question is whether they would also try to make it illegal to use (rather than to distribute) crypto software. On the one hand, if they don't do that, they have a problem with all the installed base of code. But the legalities of stopping people from encrypting code on their own computers, or writing crypto programs for personal use, seem a lot more questionable to me, and I don't know how much precedent there would be for that kind of restriction. So as I see it the main target of the ban would be distributors of software rather than end users. This would be in line with the often stated goal of the law enforcement people that their main concern is with crypto that is built in, transparent, and trivial to use, rather than hacker's crypto. So what are the impacts of this kind of ban? They might not be all that bad. Already on the net Americans have to be careful about what they say. We can't describe crypto algorithms because they might leak overseas. With a ban on domestic distribution we would still be prevented from talking about crypto. So this is not very different. Commercial companies building in crypto would have to go back to escrowed or weak encryption. All those export controlled sites would treat Americans the same as foreigners and prevent them from getting the strong crypto. The few commercial products sold in the stores which do crypto would have to be changed. Strong crypto might be distributed via an underground network, but this would be about as risky as running Internet sites that export strong crypto is today. There are very few such sites, although granted there is little call for them because overseas crypto sites are widely available. The end result is that almost nobody in the U.S. would have access to strong crypto, except for the motivated few who write their own, keep old strong versions around, or obtain new strong software illegally. This sounds bad, but as far as actual _users_ of strong encryption it is not so different from the way things are today. Weak/escrowed crypto would still be widely used and built in to communication software. The big question in my mind is whether they could get away with banning the use of strong crypto rather than its distribution. This would be much more effective from the law enforcement perspective. But they have not tried this so far even for international messages, presumably due to the serious Constitutional questions it would raise. Hal