Declan wrote:

First, the NETcenter was sold to the Commerce cmte yesterday as a way to perform successful cryptanalysis on enciphered documents. The rhetoric was all about keeping codebreakers up to date with codemakers. To anyone with a glimmering of a clue about modern cryptography, this is complete bullshit. Industry lobbyists on Monday also tried to push this line at a press conference; I called them on it and they said, no, I was wrong, this center would let the FBI keep up with the times. Yeah right.

While a cryppie center wouldn't help the FBI keep up with strong cryptography used well, they would find it very useful in dealing with weak cryptography and with strong cryptography used bozotically. The recent Denning and Baugh study on how much harm crypto has done to law enforcement investigations points this out strongly. They found that crypto has not in fact prevented successful investigation and prosecution. They did encounter crypto, and in each case they were either able to break it (because it's cheesy McCrypto Wordmaster kid crypto), or they were able to find the keywords or plaintext somewhere in the perp's house or computers. Until we have serious seamless apps, there will be plenty of chances for law enforcement to get at the plaintext one way or another. Do you use your super-4096-bit-RSA-key-international PGP under Windows? If so, do you disable and wipe your swap file? Do you use it under Linux? If so, do you even know where your swap file is? The FBI with a competent cryppie center would. Just because they couldn't break the good stuff doesn't mean they couldn't successfully support the vast majority of law enforcement investigations. Whether this means it should or shouldn't be implemented is another question -- perhaps it would serve as a spur to people to use their tools more sensibly, as well as giving the FBI something more useful to do than spending public money lobbying Congress. -- Jim Gillogly Mersday, 6 Winterfilth S.R. 1997, 18:45 12.19.4.9.14, 2 Ix 12 Chen, Fifth Lord of Night