🚀 go-pugleaf

Hugh, Terry, Chris and a host of others have given some very thoughtfull
comments along the lines of how do we keep the government from legistation on
registration or ban of strong cryptography. I have come to respect their
thoughts on the subject.

I think that the time has come to create a White Paper of the position of
'netnews' RE. How Strong Cryptography is of benifit to society and Why it must
be freely available for use, public and private.

To that end let me set down some ground rules that I hope will keep us on
track and prevent the digression to arguments between fractions.

It is my intent to get the ball running in the formulation of this white paper
as a response to those who would attempt remove strong cryptography from the
hands of common citizens. The completed white paper could take the form of a
FAQ or what the will of the netters can come up with.

As this white paper grows (if you all don't shoot it down at birth) we will be
faced with forming a consensus. Let's tackle that as we come to it. I don't
expect to have any central control (from any point) so this is a real challenge
in coorporation.

What good will it do? Well, I expect that we can turn this into a paper that we
can send to our respective elected officials expressing our collective view.
Further the white paper would be of use as a letter to the editor of your local
paper when the point should come up locally and as a starting point on the
education of local government and law enforcement persons on why not to
regulate strong cryptography and how mis-use of cryprography has been
considered in this position.

To get the ball rolling I have taken Hugh Miller's proposal and turned it into
'White Paper on SCIPH version 1' with this post as 'Discussion on SCIPH WP
version 1'.

Regards, Ethan

----------------------------------------------------------------------
            White Paper on Strong Cryptography in Public Use

GROUND RULES.

1) the white paper shall start with the ground rules
2) a version code shall be used to identify competing versions of the white
   paper
3) each version of the white paper shall be indicated in the subject line in
   the following format  'White Paper on SCIPH version n' Where n indicates the
   specific version.
4) the creation of a new version will occur when major changes to the content
   of the white paper are proposed or at any time the ground rules change. 
5) No Discussion or debate of the white paper(s) shall occur under the white
   paper subject line (see rune 3)
6) DISCUSSION and debate of proposed changes to a specific version of the
   white paper shall be noted in the subject line in the following format
   'Discussion on SCIPH WP version n'
7) All persons are open to participate in the formulation of these white papers


>     Chris Browne's wonderful post is the very voice of reason, although
> it's a gone a little short of replies due, I suppose, to the clang of
>     To start the ball rolling, a few initial efforts:
> 
>   I.    Freely accessible practically secure cryptography (FAPSC) is an
>         area in which the interests of private corporations and the
>         interests (some would say rights) of private individuals to be
>         secure in their persons and papers converge.  (They, ahem, don't
>         always.)  As one of the recent contributors to the discussion on
>         sci.crypt noted (I can't remember who, sorry!), it was supremely
>         ironic that in the same Congressional testimony in which he
>         lamented the explosive growth in recent years of industrial
>         espionage, FBI Director William Sessions went on record as
>         opposing FAPSC.  Making FAPSC illegal for the general populace
>         will severely impact the security of internal corporate
>         communications.  (Individual corporations are, I think, unlikely
>         to win exemptions to such legislation unless they do contract
>         work with the government, and then only on those specific
>         contracts.)  Such a general ukase on FAPSC would thus hurt
>         American business in a competitive world market.  This kind of
>         argument is already being made by many corporations, and loudly.
> 
>   II.   From my educated layman's view of the intelligence-gathering
>         process, two critical problems faced by analysts are (1)
>         identifying the needles of valuable information in the haystack
>         of more-or-less irrelevant data, and (2) correctly interpreting
>         that information for the end-user.  The presence of FAPSC would
>         not affect the second problem at all, as it is internal to the
>         relationship of the intelligence-gatherer and the end-user. It
>         _would_ affect the first problem, in certain ways.  It would of
>         course reduce the size of the haystack, since most of the bits
>         flowing into the intercept horns and linetaps would be
>         encrypted.  Some informational `needles' would doubtless be
>         obscured as well, and it is this prospect which exercises those
>         who oppose FAPSC.  But consider that the kind of
>         information-gathering facility which would be most impacted by
>         FAPSC is the one about which almost everybody in this debate has
>         the most misgivings: brute-force keyword searches on very-broad-
>         band comm trunks.  Here the analogy with paper mail is most apt
>         and should be played up for all it's worth: no one (or almost no
>         one) would agree that the government ought to be in the business
>         of steaming open and reading every letter passing through the
>         U.S. Postal Service in the hopes of catching someone plotting to
>         sell drugs or distribute kiddie porn, reprehensible as we find
>         such activities to be.  (Wartime mail censorhip is, of course,
>         the sole exception to this rule; but we haven't been formally at
>         war in a _very_ long time, and we have shown no inclination to
>         accept it or other related wartime expediencies even at the
>         height of the Korean, Vietnam, Drug, and Persian Gulf wars.)  If
>         by some other means (e.g. HUMINT) an intelligence-gathering
>         agency discovers several parties communicating for possibly
>         illegal purposes, it may obtain a court order by due process and
>         proceed to eavesdrop.  That the data stream that it intercepts
>         will be encrypted may not turn out to be a big problem, for
>         reasons given below.  So, taken all in all, when one counts the
>         (small) possible losses in information from ubiquitous FAPSC
>         against the enormous benefits to business and private citizens
>         from having it in place, it is clear that the balance of utility
>         is on the side of the latter option.  (Most folks love
>         cost-benefit analyses.)
> 
>    III. I propose that -- and this is, admiitedly, a stretch --
>         ubiquitous FAPSC would tend to _improve_ the quality of
>         intelligence gathered from telecomm.  Suppose, for the sake of
>         argument, that Agency N gets information that individuals A and
>         B are involved in what appears to be a conspiracy to, say, sell
>         illicitly acquired industrial secrets to company C. Further
>         assume that A and B are not professionals, i.e., trained spies;
>         assume rather that they use common carriers for their
>         communications and a trusted FAPSC package such as RIPEM or PGP.
>         Such persons are likely, given the current understanding of
>         FAPSC in the general populace, to be rather too credulous and
>         trusting of their security system.  This makes them easy
>         pickings for Agency N.  A quick trip in a Tempest van or a
>         black-bag job to obtain the secret keys of one or both parties,
>         and a wiretap, and Agency N can listen to their correspondence
>         until at least the next keychange, and maybe beyond.  It can
>         even spoof one or both parties and insert disinformation into
>         the communications stream between A and B, and have that
>         information acted on in complete trust of its authenticity.
>         This is the key point: a shallow understanding of current crypto
>         security (especially asymmetric cryptosystem) would lead the
>         likes of A and B to be more easily monitored and duped.  Shallow
>         understanding is about all that most nonprofessionals would ever
>         exhibit.  As for the professionals, of course, special means
>         will, and have always been, required to catch them; and the
>         presence of ubiquitous FAPSC will not make that task any more
>         onerous than it already is.
>