Re: "Key Escrow" --- the very idea
(1) I'm not an anarchist. Does that make me out of place here? I'm willing to live with some amount of government, as long as us owners stand a chance of controlling or overthrowing it. My biggest problem with Capstone is that it changes the balance of power too much.
Simple solution for people like you: Secret split your key into eight pieces, such that six or seven are required to reconstruct it. Create a mechanism whereby people can anonymously distribute their keys. Have the govenment escrow keep just the names of the people with the other pieces. Periodically require everybody to prove that they still have the same piece by sending hashes. When the government wants your key it presents a warrant to the people holding your pieces. But I find this sort of system to be silly. its only purpose is to eavesdrop in on my conversations. Why would I want somebody doing that? I like my privacy so I'd rather not participate.
(2) I think crimes can be committed in cyberspace. Substantially, if not entirely, in cyberspace. Maybe not so many now. But I think it's intellectually dishonest of us who understand the growing importance of cyberspace to claim there won't be any social contracts there that could be violated. I accept the terms of the 4th ammendment: search and siezure allowed when due process followed. "Key escrow" is an attempt to implement the cyberspatial analog of search.
This is total bullshit. In the physical world, the ideal set up would clearly be one in which each individual negotiated with each other individual what the contract between them would be. "I don't want to die and you don't want to die, so lets both agree not to kill each other and put some money towards a system of police that guarantees this. I want property rights so I can enjoy the fruits of my labor..." This scenario is, of course, absurd. It takes time to negotiate things like this. Negotiations also require the possibility of no agreement, allowing the parties to re-examine the strength of their respective positions before going back to the table. The cost of conducting these negotiations in the physical world is enourmous. The cost of conducting these negotiations in the real world is negligible. People who like their freedom can negotiate on their own. The stupid and the insecure can purchase agents from other people that do the same thing. LAWS CAN EASILY BE MADE OPTIONAL IN CYBERSPACE WHILE STILL MAINTAINING THEIR EFFECTIVENESS. Enforcement of a law is a natural part of the agreement to participate in it. There is absolutely no reason why one set of laws with one set of enforcers needs to be adopted simply because the transactional cost is negligible and the results of non-agreement can be determined nearly instantaneously. I will be introducing the paleolithic analog of an information society in the next few weeks. You had better believe that by the time the information superhighway takes off, complex systems that enforce complex rules will be available to those who want them.
(3) The Feds must know they can't prevent modestly well funded, educated, and motivated folks from using unbreakable cryptography amongst themselves. The argument for doing key escrow anyway is that by installing a breakable infrastructure, they'll make enough investigations cheaper and more effective to be worth it. Note that's a comparison of their money and success rate against our privacy; no wonder they got it so wrong.
It absurd to think that the Feds can control anything in cyberspace without some sort of physical world police state. Its just not feasible, entropy is dominant. JWS
Eight pieces seems too few to me. It's too easy for gov't agencies to "lean on" eight individuals or organizations (someone else suggested "watchdog" groups as fragment holding agencies, but that doesn't seem very good. Groups can change over time, respond to pressure. Putting a lot of fragments in a few hands seems fairly fundamentally flawed). I'd rather see thousands. That way, if Richard Nixon II launched a secret intimidation campaign against a group of enemies (e.g., the Democrats, or the Republicans, or the Libertarians, or the ACLU, or Sierra Club, or people opposed to the Haitian operation, or ...) --- well, it couldn't be secret, because a lot of people would have to know about it. This also requires that key fragment holders know what their fragments are for (the current Capstone architecture associates keys with devices, not people; whether that should be so is another discussion). Of course, this also diminishes the secrecy of the wiretap: if a wiretap is warranted on The Godfather's office phone, what are the odds that someone the FBI doesn't know is working (indirectly) for him will hold a fragment? Maybe that's just a price that has to be paid. What incentive can be given to the fragment holders to get them to take strong measures to protect the secrecy of those fragments? Also, if a key is split into N fragments, and there are k keys per capita (how many telephones do we have today per capita?), each person needs to hold kN fragments (even more if we restrict holders to, say, adult citizens). Can we expect everybody to spend what it takes to hold kN fragments securely? I've also wondered about another way to protect against abuse. There's been some discussion on this list about cryptographically strong time locks: a way to reveal something at a predetermined time in the future. I didn't follow it closely at the time, and don't know how feasible they are (in general, or for this application). But if they could be implemented, how about requiring the fact of a wiretap to be published M months after it's started? Again, I mean in a cryptographically strong way: you couldn't get the key you need for the wiretap without committing to revealing, M months hence, the fact that you've done so. I've also tried to pursue the analogy to current mechanisms with regard to physical searches. This analogy breaks down in a fairly important way: physical searches generally reveal to the searchee the fact that they've taken place; this means Nixon can't conduct a secret campaign against a group of people --- they'd notice they're all subjects. But a good feature of the current system that *could* be carried over to cyberspace is that the physical privacy of my house is under the jurisdiction of a local court --- and the physical privacy of *your* house is under the jurisdiction of a *different* court. We don't have just a few "escrow agencies" that protect everybody; we have lots of agencies, each of which protects a small fraction of us. This also works against being able to keep widespread abuse secret.
...The cost of conducting these negotiations in the physical world is enourmous.
The cost of conducting these negotiations in the real world is negligible...
Is "the real world" a typo? I suspect you mean something like "in cyberspace". I'm not familiar with the line of reasoning you're referring to here. I suspect it's a large topic. Does it rest on the assumption that cyberspace and the physical world are largely disjoint? I think they're not. Activities in cyberspace often "are about" or "have influence on" the real world. Sometimes vice versa. Doesn't this mean laws can't be divided into those about the physical world vs. those about cyberspace, but must in fact be about both?
participants (2)
-
Mike_Spreitzer.PARC＠xerox.com -
solman＠MIT.EDU