Loyd Blankenship asks whether PEM involves having a government agency create key pairs. I think this may be confusing two different issues. PEM does not involve having anyone else create key pairs for you. You create your own keys and keep the private key secret just as in any other public key system. However, PEM requires you to get a "certificate" from an agency in order to use the system. The certificate-issuing agency is typically expected to be your employer or your university, from my reading of the RFC's. Large institutions like these would issue certificates, which are basically similar to PGP's key signatures, which certify that you are who you say you are. The large institutions themselves would have their own public keys signed by an agency higher in some key-signing hierarchy. Last I checked, the top of the hierarchy was the company RSADSI; they would certify the companies and the companies would certify the employees. I think this part may have changed a little in the last few drafts of the new RFC. So, there's not really any government involvement. There is a centralized hierarchy for key signatures, but key generation is still an individual activity. Oh, yes, there may also be a charge for getting your key signed; this charge might be borne by the company/university in some cases. There is also a provision to get a certificate outside this system; these "persona" certificates wouldn't really vouch for anything but they would let you use PEM. I'm not sure what they will cost. The other idea which Loyd might have been mixing up with this was Dorothy Denning's proposal several months ago that all users of public key systems be required to register their secret keys with some quasi-governmental agency. (Originally she proposed the Justice Department, then later suggested an independent group.) This way if the government wanted to spy on your communications, it would have to get a court order (as it does now, in theory, for wiretaps), and take this court order to the key-holding agency to get them to reveal your secret keys. Then it could read your messages. This proposal was subjected to a very strong attack led largely by our own Tim May. It soon became known as the "lead balloon" for its lack of support and has not been heard of recently. I don't think anyone would be terribly surprised if some variant were to resurface, though. Hal Finney