I caught part of the Burns S.1726 Pro-CODE hearings on CSPAN-2 tonight. Various speakers got about 5 minutes each; most had their full testimony in the printed record in addition to informal speaking. Then the Senators got to grill them. I can't type like Kerouac, so this will be pretty random and sketchy, almost all mistakes are mine... (Punctuation, spelling, abbrevs. etc. don't count - sorry :-) There were several rounds of ~4 panelees I caught the first couple but it's ~2am. Lots of people emphasized "We recognize the legitimate needs of law enforcement, but other things are more important to national security, and crypto is Inevitable, inevitable, inevitable, so get used to it." Senator Burns was showing the NTT RSA chips - he had a bit of trouble remembering which Triple-DES pieces were 56/168/1024 bits, saying "I have a good memory but it's short :-)" Pressler arrived late (he's also busy marking up a tax bill where big airports want one kind of tax and little ones want another - used this as an analogy and ducked out soon.) He held up a copy of Applied Cryptography "I haven't read it all yet", and commented that he could ship the book out but not the floppy. "We've all got to take cracks at reading summaries of books like this." "The Cold War is over" "This is government trying to catch up, and government is 10-15 years behind." "We have to protect banking, and protect the ability of the FBI to protect people." Jim Barksdale of Netscape talked about how fast his company has grown; as with other speakers like Bidzos, he talked about how if you miss a market window, you can't catch up. His background includes military intelligence and working for a large cell-phone company, and he had no problem cooperating with the "legitimate needs of law enforcement" when they had warrants - but he considers the need for encryption to be more critical, and considers the cat to be out of the bag. He put up a poster with a web page www.thawte.com/products/sioux, a web server product competing directly with Netscape Server and products from several other people at the table here today - the product's web page emphasizes how it's not limited by US export controls. It's SSLeay based. Zisman from Lotus and Business Software Alliance talked; I missed most of it and part of Bidzos's. Jim Bidzos talked about lots of things, including the NTT chips (Burns held them up - they're small). Emphasizes NTT biggest company in world. Cat's out of bag, crypto inevitable. Flamed escrow. "Bill Gates called the latest escrow proposal 'No proposal'" Inevitability of real crypto internationally. Tim Kraus Kopf of Spyglass talked about how Mosaic is OEMed by many companies, US and overseas, and about his frustration about not being able to provide good service to his overseas customers - not only short-key crypto, but can't provide source. Decided to see how much crypto was readily available overseas, did AltaVista search for Apache-SSL, found it all over the world - PacRim, Germany, Australia, talked about how SSLeay is Australian-written, contains RSA,RC2/4,DES, etc., and is used in products like Sioux that competes with his servers and NS's. Burns asked Barksdale about whether key escrow extends powers of gov't etc. Barksdale "We're not against key escrow, just mandatory, but it won't work, there isn't a compromise, there isn't some clever back door, but it simply won't work. If we _could_ make it work, we'd have done it a while ago so we wouldn't be taking our time today" "We have some national security interests - well what are they - we can't tell you - that's like talking to a guy who keeps quoting God - NRC report last week _had_ seen all the details and said it won't work" Bidzos - to reinvent the software infrastructure to do key escrow would take 3-5 years, couldn't really trust third parties to do it. Imagine Netscape and Microsoft waiting 3-5 years doing this instead of spending their time competing. Pressler? Banks? Bidzos: In my interest the banks don't understand yet Kraus Kopf: Double encryption anyway - you'll find a safe in the locked room. Burns: American Bankers' Assoc endorsed the bill. Can't a warrant let them get information without needing escrow and wiretaps? Bidzos: We've heard aministration say the industry wants escrow - only if you carefully interpret what that means - companies may do their own, don't understand what justifies radical change that brings in third parties and mandatory escrow Wyden: What do you folks think will happen if we don't modernize? Zisman@Lotus - will really hold back technology - internet growth speed absolutely levels playing field between largest players and smallest players trmendously empowering to small business and what we're doing here interferes with that. People used to accept 40 bits, don't any more, though big customers don't think it's a "joke" like some customers say. this is a lose-lose proposition. Wyden: Bidzos - we'll hear the Admin saying foreign products aren't as good, how will we know foreign products contain what they assert? Bidzos - it's easy - can download source code & read it, see if it works, and it _does_ work as well or better. 2) test interoperability, since you can import it and verify it's identical. German and Japanese chips very good, use US patents, high school textbooks, etc. often overlooked cost - we'll have our lunch eaten here in the US as well, not just overseas markets - say MNC wants secure comms, buys Japanese. Wyden: Barksdale - concerned that overall the government has consistently been fighting yesterday's battle - everybody was against smut but private sector vs. smut cops, fortunately courts making good decisions - how to catch up and be pro-active instead of behind Barksdale - we've given fair amount of thought - dump key escrow, dump limited key lengths, won't work, last war - it's a given. Understand crypto only a portion of sigint, other ways start at source or destination - subpoenas, most people who have a mind to do harm don't use the internet, they use phones. So what can we do that _does_ work? Look for new ways, not restricting old ways to make things that won't work kinda work, worst approach. John Kerry D-Mass - My state has emormous stake, and I'm former prosecutor, trying to come to grips with choices - how do you find out what others selling - are they living up to level of proficiency they're advertising. Bidzos: Largest corp in world NTT just did the chips, would deny reality to say otherwise KrausKopf - advantage in encryption it's easy to verify because if you can decrypt it you know it works Bidzos - some of the foreign implementations don't measure up, and don't doubt some US entities can exploit, but problem - process by which deficiencies are resolved is improving rapidly, testing by import to US, next step may be for overseas products to be incompatible with US so if you want good security you need to buy South African instead of US, you can buy over Internet. They're not as good as we are, improving rapidly, larger companies _are_ as good. Kerry - is this inevitiability curve? Bidzos - yep. Intelligence folks are very good but their job isn't to care about whether we lose market share. K - if you know what we knew? Z - NRC did know, 13/16 security cleared. Market inevitability. too much Focus on key escrow instead of getting intelligence community equipped to deal with it. K - Alternatives if escrow won't work? Z - Escrow in legal sense vs. this stuff. Impractical, and won't catch bad guys, unacceptible to market. Voluntary key recovery something big companies already do, and warrants can get those from places that use them. These discussions going on for a long time, being brought to a head, need immediate relief and action so we can have a playing field where we can compete K - you do accept legitimate needs Z - sure, but reject idea that current policies affect that K - so you think it's inevitable that won't work Z - yeah K - do you believe there's potential for cyberterrorism that could impact either defense comms or financial institutions Barksdale - sure - that's why we need tight encryption instead of this loosey-goosey stuff we've got. Can you imagine pressure on holder of key escrow for international circumvention to get that file? KK - security depends on number of doors, not just lock strength. Bidzos - intelligence worried about increased costs, idiot-proof crypto, but that's the inevitability we have to accept. Significant loss of jobs and revenues if don't act, NSA doesn't understand market forces, "other than that they're doing fine" :-) and risk backlash that could completely lose them any controls, if we were to raise speed limit to 100 mph, you'd see us investing in faster police cars Burns - in Montana we don't have speed limit :-) Burns - are y'all saying this policy puts us at more risk than without it Everybody - yes, we've been saying this for long time, national security is much stronger with crypto protecting the computers we're dependent on. Bidzos? We get asked what if terrorist brings down airliner? Well, in this computer age, what if a 12-year-old does? We need crypto to prevent that sort of problem. Kerry - market share, clearly understand, trying to balance interests Wyden - are you discussing software with intelligence community? new partnership on software side like have with hardware Bidzos - couldn't agree more - NSA thinks talking AT&T & Motorola is whole industry. And without prior consultation, all we've gotten has been Clipper Chip and key escrow Barksdale - My CTO talking at NSA? conference Friday, happy to talk Zisman - expertise exists, much better to invest in intelligence-gathering techniques than implementing diversionary stuff that won't work Kerry - if you're US attorney and get a wiretap you can't read, what happens if can't break - are we saying law enforce needs new tools Barks - yes sir, just like conversation on street hard to tap K - so we just have to adjust B - yes sir Bidzos - 40-bit agreement between NSA and industry waS that 40-bit level would be periodically raised - we might not be having this confrontation if NSA'd done their part and taken us seriously Kenneth Dam of NRC Panel next on agenda - also brought with him Jules Katz former deputy USTR, 30 years export control, Herb Lin, staff director, has whole report still in printing but we can get you copies now. volume August. executive summary and full statement available Keeping confidential info private is very hard. Criminals, corporate spies, crucial systems vulnerable to all sorts of people. Crypto an important, vital tool for protecting citizens privacy and legitimate business interests. Bad Guys can also use it. Feds must weigh issues. NRC study asked for by Congress. We have diverse interests, but have strong consensus, 13/16 got cleared for classified materials, unanimously conclude that debate can be carried out reasonably on unclassified basis. Wider use of crypto will support everyone's interest even though will make it harder for law enforcement. Don't believe total drop export controls, though relaxing will help. DOmestic/Foreign version split bad at home - govt needs to make it easier for US companies. Should be easy to export DES. US world market leadership good for national security. No legal limits domestically! "National security vs. business security" is over-simplistic - protecting civilian infrastructure stengthens national security. Escrow promising but unproven, risky - resolving some issues would require legislation, but there's not enough experience to base it on anything but speculation - government should pursue for internal use, developing policy with open public discussion. Only way to get consensus is Congressional discussion. Burns - we politicians will take the parts we like and throw the rest away :-) Why are National Security folks unwilling or reluctant to try other approaches? Dam - Law Enf vs. National Security - N.S. folks recognize responsibility to protect whole country's security, including infrastructure, so they're more balanced. Law Enf has different concerns - they're interested in surreptitious eavesdropping phone conversations and data - also want to hold down crime, and computers are growing part of that, LE under pressure to solve big high-profile crimes fast and pre-empt, like blowing up World Trade Center. They have other ways to get info, e.g. subpoena, warrants, but most people don't keep records of phone calls that can be subpoenaed, and this is the heart of their concern. Burns - still vulnerable to terrorism because we're open and free, but jsut as vulnerable to industrial espionage, need real crypto to prevent. more risk from industrial than terrorists. Thought report was very complete on that. Wyden? Wyden: report ought to be real wake-up call for Clinton folks in field. Very prestigious report. Mr. Dam - you were at State in 80s, part of team advocating strong controls, why did you change your mind? Dam - crypto export wasn't big issue then, world changing fast, industrial vulnerability criticial, info security in INformation Age. Dam - wants to allow >DES export for products that make plaintext available. For people to understand the issues, they'll have to get up to speed on a lot of issues, but they're not classified ones. Wyden wants Dam to lead discussions between software folks and NSA-side, hopes some convergence and cooperation can happen. =========================================================== Next panel - HP, EDS, etc. Dan Buchanan - Zion's Data Svcs. in Salt Lake - Bank holding business. Utah digital Signatures laws. Computer breakins in financial businesses - we need strong crypto to be able to compete with foreign banks and preserve our own assets. Our biggest asset is the trust we represent to our customers - essential that we not be limited in use of crypto, flexible methodologies absolutely critical as computer power increases. EDS - we're now separate from GM, trading NYSE next monday. We're world-wide, chasing global electronic commerce markets, need secure, speedy, efficient communications, restrictions reduce our competitiveness. Pleasant calm pro-crypto speech. Good for Industry, Good for America! HP - Richard Sevick. HP speaker showing off his smart card, says 500 million around world, need stronger crypto than export allows, international competitors. HP projects 4 billion smart cards in use by Y2000, US companies can't afford to miss it, need this export liberalization. It's also an international problem, not just national - HP working with US and G7 to get international framework for crypto, needs legislative support from S.1726 - Proposes Crypto engines on servers which don't work without smartcard "flag chips" to let you use your government-approved crypto chip to authorize different levels of encryption as needed. [WCS comment - yukkk! I'm trying to be objective, but.....] Can do shopping at home with security! Companies can interchange sensitive info, level of crypto flexible as authorized by national governments. Pilots this fall with computer vendors, banks, phone companies, expect approval, want S.1726 to help them export its framework. Burns - if we're going to live in a micro-chip and supercomputer industry, why should we hang on to the old vaccuum tube? Seen proposals for smart cards for foodstamps/welfare/wic/etc. fraud prevention because foodstamps are sold on street. Joel Lisker from MasterCard - MC uses crypto for PINs, smartcards - 40-bit key way too short, computer hackers can crack in seconds, can't export strong enough smartcards without long slow negotiations. Held up Spanish chip-card from Europay, their counterpart in Spain - if we gave this kind of card to US customer, not clear they could take it with them in their wallet on trip out of US because export laws. Burns - are your customers reluctant to do business on phone, divulging account numbers etc. - Lisker - younger people usually more comfortable but older customers more concerned about compromise. Sevcik - people trust smartcards more with PINs since they can't be used if stolen. Burns - some trials of smartcards for foodstamps annoyed bureaucrats because it doesn't take as many people at the courthouse counting food stamps. ==================================== aharon friedman digital secured networks technology hardware crypto product company in NJ - 512-bit keys minimum length needed is 75 bits to be close to unbreakable. 40 not enough - can buy $400 chip to break 5 hours, etc. $300K break 0.18 seconds Security agencies would like us to use 56 bits, same $300K of off-the-shelf stuff 19 days to break, but same $300K of custom chips can break in 3 hours as described in open literature doesn't matter if escrow, can break anyway Also need key-exchange, public-key eg. RSA govt doesn't allow itself <1024 bit keys we're forced to deliver security products that we don't believe provide security. overseas customers aren't stupid, they won't buy it. Job loss estimates His company has many requests for their technology, thinks it's one of the best, 700 foreign companies request it. Large Japanese compnay wants to buy lots. We can't sell and govt dragging feet even for evaluation copies. We lose. American companies want to communicate with foreign companies - what can they buy? They'll buy NTT or Siemens. Showed "Applied Crypto" book source code in back, any criminal can type it in or buy a scanner. Ex-FBI head says "give me 5 hackers and I can bring down US" Easier to write crypto code than make a bomb - law-enforcement agencies know this. Quotes NYT editorial - clearly it's time to revise policy. robert bigony senior-vp marketing govt & space motorola in scottsdale Moto at center of debate because of products we make. ===================================================== ..... I'm not going to transcribe the rest.... and the recorded Senator Burns wants to get to lunch :-) Bill # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts@ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!