This arose out of a discussion on ukcrypto about NAI (which PGP Inc is now part of) having recently rejoined the KRA list -- I notice that nCipher are on it too, and there was a earlier exchange on ukcrypto about nCipher... ========= nCipher too are now on the KRAP list (wonder how long for?) Bruce Tober forwards from www.kra.org:
[...] nCipher Corporation Ltd.
nCipher fairly recently made some press release that was commented on on this list as sounding a bit in favour of UK/DTI/GCHQ GAK attempts. Then they claimed that it was just being read incorrectly and the text was neutral and the title that was badly chosen and by hired PR. So nCipher guys, how do you explain the membership of KRAP away?
From the last list discussion, Ian Jackson, who works for nCipher wrote:
: We do not have any weakened or GAK products. The Marketing Director : has assured me that we have no plans to produce any. also: : So, in summary, there are no artificial restrictions on the sizes of : keys which can be used, generated or stored by our units, and no : backdoor GAK or key recovery facilities. given the KRAP membership one might have cause to be worry that this may not still be true. Perhaps people using recent nCipher boards or with recent software upgrades ought to read the specs real closely -- to see if it admits to encrypting stuff to GCHQ also! Ian also wrote (in a post marked as not an official nCipher statement): : I personally would feel that putting deliberate backdoors or other : similar things into our products would be highly unethical and I would : have nothing to do with it. and: : This has nothing to do with the spooks or escrow or anything of the : kind. That's what GAK and KRAP is all about -- putting backdoors into products which the government and secret service groups like GCHQ, NSA and ECHELON get the keys to. and: : I do believe that the personal views of senior management at : nCipher - particularly towards the technical end - are opposed to : escrow et al. Perhaps those technical types could have a go at prevailing over whichever marketing type or suit decided to sign up for KRAP. This is not intended to attack Ian, as he seemed pretty much against GAK, and Niko van Someren to some extent too. Not so sure about the other non technical can Someren, but clearly someone in nCipher thinks KRAP and GAK are a good marketing ploy. Otherwise, I figure you're better off giving money to DEC alpha than supporting GAKkers. Alpha's run SSLeay pretty fast. Adam ========= and a second post, with more specifics: ========= I wrote:
nCipher too are now on the KRAP list (wonder how long for?)
here we go: http://www.ncipher.com/news/files/press/97/keyrecov.html since May 97! contains such gems as: : We are delighted to support the Key Recovery Alliance," said : Alex van Someren, President of nCipher. so that pin-points at least one GAK enthousiast at nCipher. It also makes for some rather strange contradictions. The flap about nCiphers apparent whole-hearted support for DTI GAK attempts was May this year -- nCipher had already been a paid up KRAP member for a whole year. press release continues (least there is any confusion as to what KRA as an organisation is about): : Encryption makes information readable only to a person holding a : unique "key" which will unlock the data. Encryption is critical to : ensure the security of sensitive information that is either stored : electronically or sent over public networks such as the Internet. : Key recovery is a new method that allows for authorized access : to encrypted information without the need to store or "escrow" : any encryption keys with a third party. Key recovery is an : effective tool to meet commercial, private and institutional needs. institutions obliquely mentioned being presumably the likes of GCHQ and NSA? yet Ian was saying:
: So, in summary, there are no artificial restrictions on the sizes of : keys which can be used, generated or stored by our units, and no : backdoor GAK or key recovery facilities.
saying there were no key recovery facilities, and : We do not have any weakened or GAK products. The Marketing Director : has assured me that we have no plans to produce any. and no plans to install any. yet this is what KRA is all about, and they were signed up to it already at that time. I suppose someone is now going to try to claim that KRA is all about key recovery for commercial purposes, but not for government -- but this is not the way I understand that KRA came into being at all. I think it is very much a NSA led attempt to further the clipper attempts. If I recall it started in the wake of the NSA/NIST attempts at clipper IV (or whatever number it was at by then) to coerce companies into including software based key escrow. Probably tied up with the permission to use marginally higher key lengths if the company can demonstrate to NSA a plan to introduce GAK in two year time scale (within the US), though I may be forgetting the details. Anyone like to clarify KRAs aims and history? Adam