My chat with Goeff Greiveldinger
I will be appearing with Goeff Greiveldinger, he of the Justice Dept, at a discussion of commercial key escrow next Thursday in Bethesda. Anyone with fun questions I should throw at him should contact me... Please note that the ostensible topic of this discussion is *commerical* key escrow, not Clipper per se, so I have to be diplomatic.... A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin@law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | New address, but it's still just as hot here.
Michael Froomkin <froomkin@law.miami.edu> writes: I will be appearing with Goeff Greiveldinger, he of the Justice Dept, at a discussion of commercial key escrow next Thursday in Bethesda. Anyone with fun questions I should throw at him should contact me...
Please note that the ostensible topic of this discussion is *commerical* key escrow, not Clipper per se, so I have to be diplomatic....
You might try addressing the areas of liability for escrow agents. If private escrow agents can be sued for loss of information due to theft or other authorized or unauthorized release of keys, their liability could be horrendous, depending on the value of the compromised data. Gillogly Software certainly will not be a commercial keyholder! Jim Gillogly 24 Winterfilth S.R. 1995, 20:20
On Sun, 15 Oct 1995, Jim Gillogly wrote:
Michael Froomkin <froomkin@law.miami.edu> writes: I will be appearing with Goeff Greiveldinger, he of the Justice Dept, at a discussion of commercial key escrow next Thursday in Bethesda. Anyone with fun questions I should throw at him should contact me...
Please note that the ostensible topic of this discussion is *commerical* key escrow, not Clipper per se, so I have to be diplomatic....
You might try addressing the areas of liability for escrow agents. If private escrow agents can be sued for loss of information due to theft or other authorized or unauthorized release of keys, their liability could be horrendous, depending on the value of the compromised data. Gillogly Software certainly will not be a commercial keyholder!
Jim Gillogly 24 Winterfilth S.R. 1995, 20:20
You also might point out that commercial escrow is in a way MORE prone to compromise because it effectively doubles the number of entities entitled to demand release of the keys. Instead of JUST government, you now have to face the possibility of key forfeiture by BOTH government and the commercial escrow agent, the escrow agent being, as it is, subject to the whim of governmental coercion to release keys as well as the agent's own reasons for doing so. Effectively the potential for misuse is increased by virtue of the increased numbers of officals (commercial and public) who have access to the material. I would like to hear the answer to this dilemna, which I am sure will include something about commercial key escrow easing the perceptions of the public, to which the obvious response will be, "Then this is a public relations move to avoid the perception of potential government abuse and a move which infact increases the level of risk, is that right?" Perhaps I should attend. Where and when is this precisely? --- "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information
You also might point out that commercial escrow is in a way MORE prone to compromise because it effectively doubles the number of entities entitled to demand release of the keys.
Actually, any publically known escrow system opens your communications to any lawyer who gets a blanket discovery subpoena. These are very popular these days and often include third parties to any lawsuit. Anyone who can convince a judge to issue an order... DCF
On Sun, 15 Oct 1995, Black Unicorn wrote:
Effectively the potential for misuse is increased by virtue of the increased numbers of officals (commercial and public) who have access to the material.
Does he mean mandatory commercial key escrow (as in clipper keys held by credit agencies?) Or something totally voluntary but standardized by the gov? *Rant mode on* I've heard cracking into Equifax and TRW is considered a rite of passage in the phreaker crowd. The security would have to *damn* tight (as in forget it) for it to be trustworthy. And since it would probably be the big three credit rating agencies (I forget the other one), their track record is not reassuring. I don't see these people securely using crypto throughout the entire org (in such a large org) in the future if they don't already. Seeing my key sold to Son of Blacknet(LD) by Sons of Mitnick is not reassuring. For that matter, what sort of databases would they consider holding this on? And how easy would it be for the general public to get access to their key, to verify for accuracy and revoke compromised keys. (big prob with the credit rating agencies) Who would be allowed (if anyone) or mandated (depending on which scheme) to certify the security? If NSA is mentionned, one might also point out the job Matt Blaze did on their Clipper. Bad production values don't make for good public security. Of course it all depends on exactly why they really want the escrow anyway. If people will encrypt a second time with tomorrow's pgp, why should anyone care? All you'd single encrypt for would be your income tax and the financial records you're already required by law to keep (I'm sure I've misunderstood this. Can't be so useless.). I know that's not a particularily diplomatic carry-over from the debated-to-death clipper thing, but really, except as PR, why DO they still take this seriously? (unless you want to be paranoid about a ban, hmm, nevermind, debated-to-death) Speaking of organizational crypto, anyone know what the scheme used in Notes is? I know there's RSA... This seems rather more useful to examine than MS's browser, considering corporations are making it a standard for groupwork. All you'd get on a browser would be credit no's and maybe e-mail. Notes nets might carry the entirety of a company's docs and work in progress. They do export it, right? Weakened foreign version or one 40 bit key version for everyone? How about novell netware? (Yeah, I do realize most folks don't have it, neither do I. A free client would be very nice, Mr. Gerstner, for everyone.)
On Sun, 15 Oct 1995 s1018954@aix2.uottawa.ca wrote:
On Sun, 15 Oct 1995, Black Unicorn wrote:
Effectively the potential for misuse is increased by virtue of the increased numbers of officals (commercial and public) who have access to the material.
Does he mean mandatory commercial key escrow (as in clipper keys held by credit agencies?) Or something totally voluntary but standardized by the gov?
The problem exists in both these examples.
Of course it all depends on exactly why they really want the escrow anyway. If people will encrypt a second time with tomorrow's pgp, why should anyone care?
When you see a glaring hole in argument for a government program, you should smell the stench of fish in the air. That is the section of the puzzle that is being hidden until a politically "ripe" time to stick it in place. Here that piece is, obviously, banning tomorrow's pgp.
All you'd single encrypt for would be your income tax and the financial records you're already required by law to keep (I'm sure I've misunderstood this. Can't be so useless.). I know that's not a particularily diplomatic carry-over from the debated-to-death clipper thing, but really, except as PR, why DO they still take this seriously? (unless you want to be paranoid about a ban, hmm, nevermind, debated-to-death)
I'm not so sure it's paranoid. You have trial baloons floating all over. Freeh is a prime example, and no one is screaming loudly enough to shoot down his blump. That's a big'ole green light for regulators.> --- "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information
Those seeking more info on the conference will find it at: Http://www.multicorp.com/wec. They are asking over $500 in registration fees, which strikes me as wildly excessive, so I'm not advocating attendence. The third member of my panel, Frank Sudia of Banker's Trust has pulled out, so don't believe everthing you read either. I might post the outline of my talk in a day or two if I get around to translating my cryptic jottings into ASCII. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin@law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's hot here. And humid.
On Sun, 15 Oct 1995, Black Unicorn wrote:
in place. Here that piece is, obviously, banning tomorrow's pgp.
Frankly I think that's what it would take for everyone to start using it (not that I would on this multiuser account, that's what winsock and my pc are for). Just look at lsd, until it became illegal, only researchers and psychiatric patients took it. Strange things like crypto really become popularized (even through notoriety) when they "shouldn't" be had. Also seems like the only way to get any mainstream press. Bad press is better than next to none. BBrother schemes like clipper also generate lotsa mainstream press. I can't wait for Freeh and Clinton to start making sweet releases about the sequel. Big ones. What's going on on that front anyway?
except as PR, why DO they still take this seriously? (unless you want to be paranoid about a ban, hmm, nevermind, debated-to-death)
I'm not so sure it's paranoid. You have trial baloons floating all over. Freeh is a prime example, and no one is screaming loudly enough to shoot down his blump. That's a big'ole green light for regulators.>
Being paranoid is a prerequisite for being on this list in the first place :-) But seriously, yes I do agree with you. We know just how much they'd love to get rid of it. That being said, wasn't legal protection for crypto the reason EFF caved on the dreaded DT bill? (sorry, DT law. Yech, that's tough) First they're going to have to get rid of that. How strong is the protection anyway? *Begin flogging dead horse* (not a Unicorn) Flog Fine, let's just say I don't think I it can stick, we could argue this back and forth and I'm sure it's been done before. We benefit from any move towards a ban through a measure of publicity. We benefit once again from a ban due to programmers like Phil Z. getting terrified and outraged enough to write code. PGP is the product of a previous attempted ban. We'd be have PEM or RIPEM otherwise (with no-one using them). Flog If there is a market to avoid american anti-privacy and subpeona regs, openly or in the black, this is where it will get its start. I understand that key signing parties are all the rage at ietf meetings. I think a lot of those people would be angry enough to go for a strong privacy IP before any ban went into effect. Remember the US is not the whole of the world. Go to Anguila or Vancouver or Montreal or Baja Cali...with those thoughts in your head, and you can have your cpunk ietf meeting and implement and distribute the code. Flog Flog Flog And then there's the courts... I think any ban of a "desirable" product is self defeating. Just look at how little popular and even police support the marijuana ban has. Even Newt admits to having tried. Unlike crypto, marijuana has a physical presence and requires transportation, even then it's also totally unenforceable (even though it lands a very large amount of people in jail). A lot of people OTOH support the ban on cocaine, yet somehow, supposedly crack only costs $5/vial in NYC, and is available in every city in the world. A crypto ban would be even harder than making people pay for all their software. Pirate software is illegal in most of the world. Are the fine legislators of North America, where practically all the software is written, totally innocent of this heinous crime? It can't stick. Either outcome puts crypto and anonymity ahead in some way. End of dead horse flogging. Sigh. Sorry for an overlong post.
participants (5)
-
Black Unicorn -
Duncan Frissell -
Jim Gillogly -
Michael Froomkin -
s1018954＠aix2.uottawa.ca