🚀 go-pugleaf

In article <7648@transfer.stratus.com> cme@ellisun.sw.stratus.com (Carl Ellison) writes:
>
>Politics aside for a second, there's an interesting crypto problem here.
>
>Let's say, for the sake of argument, that we wanted to let all the phone
>companies sell encrypting modems and voice scramblers using triple DES
>for the stream encryption (with 3 keys) and RSA for key exchange.
>
>We should be able to design a protocol/system such that:
>
>1.	a digitally signed court order to do a specific wiretap must be
>	presented to unbribable/uncrackable machinery in order to recover
>	one session key.
>
>2.	digitally signed court orders have expiration dates -- and short
>	lives.
>
>3.	an audit of all taps performed is sent immediately to the US major
>	news services, encrypted under a key which will become available
>	to them after some decent delay (2 days?) and the availability
>	of which can not be prevented.

At Crypto 92, S. Micali proposed someting he called a "Fair Cryptosystem."
This is a public-key cryptosystem with the added property that the secret key
can be divided up into pieces.  Putting the pieces together will recover the
secret key.  However, unlike normal secret sharing schemes, the holder of one
of the pieces can convince himself that the piece is valid.

The thought behind this is that pieces are handed out to various parties:
the FBI, the Supreme Court, the ACLU, etc., and a court order is rqeuired to
bring all the pieces together and recover the secret key.

Neat mathematics, and it works.

Bruce