🚀 go-pugleaf

I'd like to suggest another possibility, which for want of a
better name I'll call the "copper balloon".  It's quite clear that key 
registration goes over like a "lead balloon".  My question is: is this 
any better?  worse?  I would also like to suggest that we keep this
thread focused on this proposal and not on the merits/demerits of
wiretapping in general.

The basic idea is very simple.  Use a 3-way Diffie-Hellman public-key
exchange protocol to set up a session key for use with say DES 
encryption.  The third party would be the service provider (actually
equipment owned by the service provider), which would make the key
available to law enforcement if a court order has been received and
an intercept activated.   Here's a concrete scenario for telephone
security devices:

1.  Caller activates call.  All 3 parties generate a random x and
exchange their values y = a^x mod p for some a and p.  All 3 parties
generate the key k in the style of DH but with 3 exponents instead
of 2.

2.  If a tap has not been activated, the 3rd party would be a bit
bucket.  The key would not be saved or distributed elsewhere.  Indeed 
the third party might even play a slightly different game and issue
a random y without even having generated an x.  

3.  If a tap has been activated, the key would be delivered to the 
government monitoring facilty along with the communications stream.

The idea for this came from several places.  First, encryption can 
be used without the need for users or devices to have permanent
secret keys.  For example, at least some telephone security devices 
have no keys wired into them.  The session keys are negotiated at 
the time of the call.  Diffie-Hellman does not require any concept
of a permanent key.  Doug Jones posted a message earlier mentioning
a scenario that would not use permanent keys.

Second, the trick is basically the same as used by Silvio Micali in
fair cryptography, though he had 5 parties.

Third, someone (Carl Ellison?) suggested that it might be better to
just record session keys rather than permanent keys.  Since the 
session keys are what is ultimately needed, this sounds good to me.

Obviously this would not work with PGP or any form of RSA encryption
which uses permanent keys.  So if such a strategy were used, it would
constrain what protocols & methods could be used.

Like key registration, I expect it would be much harder to enforce on 
computer nets that run software than telephone systems where you could 
require that hardware products meet the basic requirements.

Assuming that the 3rd party devices were reliably constructed, this 
would at least superficially provide more protection since no keys 
would be kept unless a court order were issued.

OK, fire away.

Dorothy Denning
denning@cs.georgetown.edu