Interactive Week exclusive - White House to launch "Clipper III"

The White House is about to answer recent attempts to liberalize encryption exports with a proposal of its own. Documents obtained by Interactive Week show the Ciinton Administration has been lobbying key Republican committee members to compromise on encryption through a policy that looks very much like previous commerical key escrow efforts. This time, however, the administration has proposed a new, licensed network of certification authorities and escrow agents to control access to strong encryption abroad. The newest proposal is contained in a 24-page White Paper, a draft of which hit Capitol Hill earlier this week. Much of the administration's "key management infrastructure" assumes a similar network of certification authorities abroad. CAs would link public keys to their owners, and could serve as escrow agents for users' private keys, as well. The two would not have to be under the same roof, however. An overarching "Policy Approving Authority" would supervise all subordinate CAs and escrow agents. Since US escrow of exported products pose well-known problems for privacy and business concerns, the US is proposing foreign governments get into the act as well. If other governments acted as escrow agents, the Clinton White House argues, interlocking agreements among governments would protect all their common security concerns while giving non-US citiczens access to US encryption products. The ultimate goal, the White House says, is to allow export of anything at all, so long as keys are escrowed with an agent of its approval. The White House is evidenty relying on OECD initiatives for much of this to happen. Specifically, the "Clipper III" paper says that: U.S. companies can export software programs that use keys that are 64 bits of data long, if they agree to escrow keys that unlock the encryption in the U.S. or with an appropriate agency abroad. Manufacturers can export hardware that use 80-bit keys to encrypt data, if keys are escrowed. Large U.S. companies can escrow keys and not rely on third parties. Reaction is as before. Civil libertarians are already denouncing the White Paper, while pro-escrow forces are praising it. Staffers to Commerce and Judiciary committee call it the same old proposal, but with a large bureaucracy behind it. Quoted in the Interactive Week article: David Sobel of Electronic Privacy Information Center, Dorothy Denning og Georgetown U. and Stewart Baker, former NSA counsel. Hill staffers also quoted on background. The URL for the complete article is: http://www.zdnet.com/intweek/daily/960518y.html Will Rodger Washington Bureau Chief Interactive Week

Excerpts from internet.cypherpunks: 18-May-96 Interactive Week exclusive .. by Will Rodger@interramp.co
The White House is about to answer recent attempts to liberalize encryption exports with a proposal of its own. [...] The newest proposal is contained in a 24-page White Paper, a draft of which hit Capitol Hill earlier this week.
Kudos to Will for running this story. Today I snagged a copy of the White Paper, which comes with 12 pages of tortured crypto-justifications and 12 pages of appendices, with darling hierarchial diagrams of how U.S. and foreign certification authorities will interact. (Hint: The PAA, or Policy Approving Authority, is at the root of each country's or region's certification hierarchy.) It's very anti-anonymity: "Without a KMI of trusted certifying authorities, users cannot know with whom they are dealing on the network..." And not very cypherpunkly: "A number of principles need to be accepted by government, industry and other users... Self escrow will be permitted under specific circumstances. The escrow agent must meet performance requirements for law enforcement access." Basically, what the White Paper does is pay lip service to free market competition and suggests loads of government/industry initiatives, but it's always with the gummit wearing the steel gauntlet beneath the felt gloves. It concludes by promising industry a transition into unlimited key-lengthy export, provided they follow the rules: "As trusted partners, industry and government can share expertise and tackle intractable problems such as the insecure operating system. In times past, the cryptographic algorithm was the core of the solution: now it is the easy part. The debate over algorithms and bit lengths should end: it is time for industry and govenrments to work together to secure the GII in such a way that does not put the world at risk." -Declan
participants (2)
-
Declan B. McCullagh
-
rodger@interramp.com