CDR: Phil Zimmerman Profiled

[James D. Wilson]

Watch the word wrap:

http://developer.earthweb.com/earthweb/cda/dlink.resource-jhtml.72.1081.|rep
ository||softwaredev|content|article|2000|10|03|SDLairdZim|SDLairdZim~xml.0.
jhtml?cda=true

(PGP Signature applied with appreciation to PRZ)

Meet Phil Zimmermann, creator of the Pretty Good Privacy (PGP) encryption
suite and one of the world's best-known cryptographers.

Published  October 04, 2000
By  Cameron Laird
Page 1 of 2     1  2



Programmers can be celebrities too. Just ask Philip (Phil) Zimmermann. He's
spent most of the last decade as a folk hero, and admits to having enjoyed
that status. Just this summer, he suffered the flip side of fame as wildly
inflated rumors circulated about his role in compromising the security of
the PGP encryption suite, and he watched his e-mail inbox fill with venom.

A Human Rights Project


He recognizes it comes with the territory. Zimmermann is probably the
world's best-known cryptographer. He created the Pretty Good Privacy (PGP)
encryption suite in 1991. Since then, it has come to dominate the market for
programming protection of online confidentiality. PGP has been heralded for
its role in protecting numerous political dissidents around the world, and
earned Zimmermann the prestigious Norbert Wiener Award for responsible use
of technology in 1996, as well as the 1995 Chrysler Award for Innovation in
Design, and a 1998 Lifetime Achievement Award from Secure Computing
Magazine, along with at least a dozen other distinctions. It also brought
him into highly public patent disputes with RSA Data Security Inc., and a
nightmarish multi-year criminal investigation by the United States
government.

It began as a human rights campaign. As the '90s opened, Zimmermann was an
experienced programmer -- and a pretty good one by all accounts, including
his own -- specializing in data security and communications and real-time
embedded systems. Electronic communications technologies were becoming
widely available, and politically significant: combinations of underground
radio, video tapes, satellite news updates, and e-mail are generally
acknowledged to have been indispensable in the popular overthrow of Iran's
Shah, Eastern Europe's Bolsheviks, and several dictatorships throughout the
third world.

Technical challenges remained. How, for example, could human rights monitors
communicate their on-site findings without risking recrimination or
distortion? How might any citizen communicate freely and fearlessly over
channels subject to tapping?

One technical solution was encryption: "scrambling" a message so it was
unreadable except to the sender and intended receiver. Zimmermann had worked
on commercial encryption systems during the '80s, and he envisioned that it
could be applied more widely. He developed PGP as an "add-on" that any
e-mail user could install to ensure confidentiality.

A Response to Legislation


And it worked. It also became controversial, which brought more attention,
and encouraged even more users to experiment with it. Nowadays it's become
part of the popular culture of computing. It has been so widely disseminated
that even many industry participants who rely on it know nothing about
Zimmermann, and assume it was first created for the commercial
applications -- retail sales, banking, and so on-in which it is used today.

Zimmermann, however, emphasizes that for him it remains a human-rights
project.

PGP was born in controversy. Zimmermann wrote version 1.0 as a response to
United States Senate Bill 266. If it had been passed, this legislation would
have required all communications vendors to embed "back doors" to permit
government agencies to tap their products. He rushed a release of 1.0 into
the hands of his computing friends, at least one of whom began to distribute
it on bulletin boards throughout North America. Its circulation meant that
any criminality resulting from passage of the bill would have been difficult
to enforce.

Code-sharing didn't stop at national borders, though, and there was nothing
hypothetical about it: export of PGP outside the U.S. (with possible
exceptions involving Canada) was definitely illegal. Everyone involved
agreed that the Office of Defense Trade Control's enforcement of the
International Traffic in Arms Regulations (ITAR) extended to cryptographic
software.

Whom to Prosecute?


Whom could the US Department of Justice indict, though? Zimmermann just
programmed and talked; he was careful not to engage in any "munitions
exports" himself.

Despite these precautions, criminal charges were brought against him. The
programming and civil rights communities joined to create a legal defense
fund. After three years of what Zimmermann calmly categorizes as
"persecution," prosecutors dropped the case in early 1996 with as little
comment as they had earlier justified it.

Controversy didn't end there. Even before the criminal indictment, RSA
notified Zimmermann that it considered PGP an infringement of its patents.
Zimmermann had been careful to engage only in "educational use" of
applicable documents and inventions. He consistently emphasized in his
presentations that users were responsible for securing applicable licenses.

The RSA battle ended as undramatically as the ITAR one had. Zimmermann and
Public Key Partners (PKP), an RSA affiliate, signed an agreement that
Zimmermann would continue not to distribute RSA inventions and PKP would not
sue Zimmermann. RSA threatened Zimmermann and the Massachusetts Institute of
Technology (MIT) for various alleged infringements. Zimmermann programmed
around legal problems, and MIT shielded him from others in pursuit of its
own intellectual rights.

While the publicity around these disputes served as valuable marketing for
PGP, it also made it hard to move on. Hecklers continue to believe, for
example, that Zimmermann had secretly acquiesced to government demands and
somehow weakened PGP. Although it's hard to prove covert arrangements do not
exist, it's equally difficult to imagine how Zimmermann might contaminate
source code available for public review, which PGP was.

PGP Inc.


With the disposal of the government case, Zimmermann founded PGP Inc. in
1996 to finance maintenance and enhancement of PGP. Late the next year, he
sold the company to Network Associates (NAI), while agreeing to stay on as
senior fellow.

The programming fraternity continues to honor Zimmermann in its
characteristic ways: T-shirts are silk-screened with him as subject, he
speaks regularly at conferences and in the classroom, and people who haven't
met him often speculate on Usenet and other public forums about his motives
and interests. He is often addressed with the reverence accorded an
accomplished software engineer martyred for resistance to governmental
invasions of privacy.

PGP's Present and Future


So where are PGP and Zimmermann in the year 2000? He still has a full
schedule. Between his assignments with NAI and independent consulting, he
sometimes fails to make adequate time for sleep, let alone pack carefully
for his many professional travels. He does little coding these days.
However, he sees his contribution as critical, believing that "encryption
software architectural decisions must be made by knowledgeable
cryptographers, not software engineers." He has very firm opinions, for
example, about Gnu Privacy Guard (GnuPG), an open source competitor to PGP.
There's no doubt in Zimmermann's mind that GnuPG suffers for being managed
by programmers. He offers the Blowfish encryption method as an example: "I
would never, ever allow Blowfish to be implemented in PGP, because it's not
as good a design as Twofish; Twofish is superior. PGP 7 implements Two fish.
Yet we see GnuPG implemented Blowfish."

Even the Internet Engineering Task Force (IETF) makes cryptographic
mistakes, he says. Zimmermann asserts, "I would never allow El-Gamal
signatures to be put in PGP. I don't know how that got in" RFC 2440, which
defines the OpenPGP standard.

NAI still has a large backlog of serious technical work to do: integration
of new algorithms and functionality, ports to new architectures, and more.
Embedded systems -- encryption processing within telephones, automobiles,
and so on -- are likely to be particularly important during the next few
years. Also, the original RSA patent expired just a couple of weeks ago, and
NAI is already offering products that exploit this.

Minor controversies continue to dog PGP. Just within the last year, two
small faults in the released code were discovered. While experts agree that
neither one presented any practical danger to the security of PGP-based
communications, both sparked arguments about NAI's ability and even its
intentions. In the first case, a fault in a specific version for Unix could,
in principle, compromise a key generated by a method PGP had always
deprecated: automatically, without user input.

Then, in mid-August, German researchers spotted an error in PGP's Additional
Decryption Key (ADK) functionality. Like the key-generation error, it was
quickly fixed, and detailed investigations confirmed it was unlikely that
any real keys had ever been tampered with, let alone any messages cracked.
However, before all the facts came out, speculation erupted that Zimmermann
had personally installed a deliberate vulnerability, or perhaps allowed NAI
to do so.

Zimmermann promptly published an extensive personal statement through the
PGP Web site, and most observers now grant that, as he concludes there, "If
NAI tried to put a back door in PGP, all the engineers on the PGP team would
quit in a highly visible protest, and I would be talking to the press about
it. There is no way that I would let this happen."

The Future Is Busy


Zimmermann's personal scheduling often leaves him in what he calls
"decapitated chicken mode." Apart from the frustration of overload, he likes
what he does, and proudly regards it as important technically and
politically. He's just beginning to redevelop PGPphone on his own, outside
NAI: "I think it's a cool project." He continues to speak before university
and industry groups, often in Europe. However painful the name-calling and
conspiracy theorizing is to him, he plans many more contributions to
cryptography and computing.