🚀 go-pugleaf

    Terry Ritter writes:

>What corporations (e.g., banks) have typically screamed about is the
>right to continue to use DES. A few months ago, corporations were
>screaming about possibly being required to provide remote monitoring
>access to their private telephone switches.  None that I know of is
>fighting, say, for the right of their employees to use cryptography for
>personal communications or data storage.

    But there _have_ been calls for the continued legality of public-key
cryptosystems, since businesses recognize the key-management advantages
such systems provide over single-key ones like DES.  Most corporations
seem happy with the security DES affords, but would like to dispense
with single-key management problems.  It is trivially true that
corporations have no interest in supporting such crypto for the personal
communications of their employees, since they don't want to pay
employees for personal affairs, only for business ones; and it is
equally trivially true that they would not be concerned with using
crypto for internal data storage, since other systems already in place
(physical security, access control, tape lockups, etc.) have been paid
for and can be expected to do their jobs reasonably well.

> I see no reason to think that corporations would not be granted
> easy-to-get licenses if they use particular types of equipment.
>
> In fact, a March 1987 article in Data Communications magazine
> described NSA's Commercial Comsec Endorsement Program (CEEP) and
> Project Overtake encryption equipment in two classes:  Types I
> and II.  Type I would be available only to government agencies and
> contractors, but a Type II "module" would be a replacement for DES
> equipment, and would be built into a computer or communications
> device and sold by a vendor.
>
> This program was not a success (they "ran it up the flagpole" and
> nobody saluted), but, clearly, NSA *is* prepared to support the
> concept of data encryption for business.  Not unexpectedly, there
> was no proposal to provide low-cost consumer encryption, a topic
> which has been at the heart of the argument here for the past week.

    As I pointed out in my original post, the government would likely
support practically secure crypto for communications between its
contractors and itself.  (There's your `Type I' equipment.)  For
everybody else who wants it, NSA will be happy to ship you a board with
some proprietary blackbox chips on it for use in your PC, plus a 16-page
manual containing instructions and a mantra, "Trust us." (There's your
Type II.)  This is not `practically secure' crypto, since it violates
Kerckhoff's Assumption.  Corporations, who pay good money to hire good
security people who know about such things, did not `salute,' as you put
it.  On the basis of clumsy proposals like this I think it can be
reasonably concluded that NSA supports "data encryption" if you are
Martin Marietta communicating with Pentagon boffins about weapons
systems; otherwise, it supports "data encryption" which we can be
reasonably sure cannot be read by anybody but your intended recipient
and the NSA.
    _Of course_ NSA will not support freely available practically secure
crypto for the masses.  In its view, such a thing would only make its
own task, and that of domestic LE, harder.  But the burden of my
argument (and that of others in this thread) is that we must try to come
up with arguments, convincing to the public and legislators, why FAPSC
should be allowed anyway.

> Business use and personal use are two different things.  I think
> it quite likely that the government would like to license the
> first, and minimize the second.

    I disagree (about business use).  A great deal of intelligence is (I
understand) gotten from intercepts of business communications.  Why
should intelligence agencies want to see that stream dry up?  (That's
the whole reason, as I see it, for the `Type II' Overtake equipment.)

> Consequently, arguments based on American business competitiveness may
> be totally irrelevant to the continued use of strong cryptography by
> individuals.

    I still think that we have to try to construct _rhetorically_
convincing arguments which, for example, piggyback FAPSC for the general
public on the need for its use by business.  Politics makes strange
bedfellows, and if keeping FAPSC legal for the use of business allows us
to keep it legal for use by the masses, let's not kick our allies in 
business out of the sack.

    -=- Hugh
Hugh Miller         | Dept. of Philosophy | Loyola University of Chicago
Voice: 312-508-2727 |  FAX: 312-508-2292  |    hmiller@lucpul.it.luc.edu