Forcing developers of encryption algorithms to give the gov't a key?

[sailor]

I found a source explaining how things stood in the US about 1996. Data Security Tutorial by MaeDae Enterprises (they explicitly give permission to reproduce it).

Overview of USA Regulations

The USA government, in its usual cryptic fashion, classifies encryption software under the International Traffic in Arms Regulations (ITAR). The ITAR does not deal well with technical data that can exist in many different forms and flow across national boundaries on BBSs, Internet, and other electronic services. In fact, some of the best source code for encryption techniques, regulated by the ITAR, frequently originates outside the USA. This source code can be imported via electronic means, built into commercially competitive products, and then cannot be exported to the world-wide marketplace. Examples of this are the DES and IDEA (from Switzerland) encryption techniques which are available in commercial products throughout the world, but cannot be exported outside the USA and Canada.

ITAR currently makes a distinction on what type of encryption software can be exported primarily based on the complexity of the encryption algorithm (sometimes linked to the number of bits in the encryption key). It is tied back to whether the US government feels they can break the encryption technique given their super computer resources. Basically, it goes something like this:

• XOR, transposition, substitution, and the like can be freely exported.

• RSA 40 bits or less can be freely exported.

• RSA 41-64 bits cannot be exported unless you build in a back door and give the government the key.

• RSA greater than 64 bits cannot be exported.

• DES cannot be exported unless you build in a back door and give the government the key.

• Other encryption schemes like the 128 bit IDEA or 448 bit Blowfish cannot be exported.

I believe things have changed substantially since then but even then it was a joke as everybody and his brother around the world were using PGP and other systems.

[sailor]

A 1994 article How to Keep It A Secret mentions CLIPPER AND SKIPJACK

More recently, the government has become embroiled in controversy over the proposed Clipper chip (lately renamed the Key Escrow chip), which was designed by the National Security Agency (NSA) for the purpose of encrypting data transmitted via secure-voice products (for example, specially built telephones). The controversy comes because the NSA won’t release details of the encryption algorithm, which is named Skipjack, and more importantly because there is an acknowledged "back door "into the chip that would allow the government to decode transmissions. Theoretically, the back door would be used only by law enforcement and intelligence agencies for legitimate purposes in the fight against crime, but giving the government such broad power to eavesdrop on private, supposedly secure conversations makes a lot of Americans uneasy.

The Skipjack algorithm itself is secure, or so the NSA claims. (The NSA did allow a panel of outside experts to examine the algorithm, and a preliminary report from the panel seems to verify the NSA’s claims.) It’s the design of the chip that allows privileged access to encrypted data. Manufacturers of secure data products aren’t forced to use the Clipper chip, but the government’s restrictions on the export of encryption devices means secure- voice products that do not use the government’s chip may be limited to U.S. markets. At the moment, the Clinton administration appears resolved to leave both the back door and the export restrictions in place, presenting U.S. manufacturers with an unenviable choice.

In the same page you can find a link to a very extensive discussion of the Clipper/Skipjack issues with NSA.

[kferr]

To calm things between sailor and Urban Ranger lets just call it the ‘secret key’. If a public key scheme was used then it will be your private key they are after, if it was a symetric cipher (DES or IDEA) then it will be that key.

I agree that quantum cryptography only guarantees a secure transmission channel. It is provable that any attempt to evesdrop on such a channel is instantly detectable by the parties doing the communication.

We’ve had a perfectly (as in mathematically perfect) secure cryptosystem for years, it’s known as a one time pad. It’s just the extremely difficult problem of key distribution that makes it impractical.

[Urban_Ranger]

I was just being pedantic

[Urban_Ranger]

*Originally posted by kferr *
We’ve had a perfectly (as in mathematically perfect) secure cryptosystem for years, it’s known as a one time pad. It’s just the extremely difficult problem of key distribution that makes it impractical.

The pads are the key (sorry for the unintended pun). AFAIK only spies use one-time pad.

[micco]

*Originally posted by kferr *
**We’ve had a perfectly (as in mathematically perfect) secure cryptosystem for years, it’s known as a one time pad. It’s just the extremely difficult problem of key distribution that makes it impractical. **

This is getting pretty far OT, but I must take issue. A one time pad is a provably secure algorithm; it is not a system. There is no such thing as a provably secure implementation because the “system” must include key exchange/storage, which is a very different problem and one which makes OTPs impractical for almost every potential use.

[micco]

*Originally posted by Urban Ranger *
** AFAIK only spies use one-time pad. **

Unfortunately, that’s not true. There are several of commercial products which pretend to have “unbreakable” encryption which are actually poorly implemented one time pad schemes. Peruse Bruce Schneier’s snake oil section in his Cryptogram newsletters for details.
http://www.counterpane.com/crypto-gram.html

[Omphaloskeptic]

*Originally posted by sailor *
**We have discussed this in past threads and i still believe there is much hype and exageration and confusion. until someone can better explain it to me I believe so-called “quantum cryptography” is not cryptography at all but a means of building a secure transmission channel which is a completely different thing. **

There’s certainly some confusion, but the possibility of a provably-secure public channel is a pretty big thing in cryptography. The current methods of quantum cryptography (variations on the “BB84” scheme, proposed by Bennett and Brassard in 1984) are indeed methods for secure “key distribution”: that is, methods by which two people can use publically-accessible channels to share a provably private key. (There are caveats. In particular, like all communication schemes it’s vulnerable to a man-in-the-middle attack.)

But key distribution is an important topic in cryptography, so saying it’s a “completely different” thing is not correct. (For example, RSA is clearly an important cryptographic algorithm, but it’s only used in PGP for secure distribution of a key to a second, faster algorithm (like IDEA).) I guess you could criticize such a statement for imprecision, but I don’t think you could claim that it’s wrong. If secure key distribution is possible then lots of cryptographic protocols can easily be implemented on top of that (for example, the one-time pad, for which the biggest current difficulty is key distribution). Since transmission of the information is often when it is most vulnerable to interception, making this channel secure would improve the overall security of a cryptosystem by quite a bit.

(Off the subject slightly, the other half of the field, advanced quantum algorithms for cryptology, also has some nontrivial advances. A working quantum computer would break PGP (and other schemes based on the assumed difficulty of integer factoring or computing discrete logarithms) and make even brute-force searches of other cryptosystems’ keyspaces quite a bit faster. I’m not sure how important this is. Once these weaknesses become known, people will presumably change to less-vulnerable algorithms. On the other hand, if the NSA has saved lots of encrypted messages with possible long-term relevance, they can now have another crack at them with their new methods.)

[Urban_Ranger]

*Originally posted by micco *
This is getting pretty far OT, but I must take issue. A one time pad is a provably secure algorithm; it is not a system. There is no such thing as a provably secure implementation because the “system” must include key exchange/storage, which is a very different problem and one which makes OTPs impractical for almost every potential use.

The only possible scenario I can think of that can use to break one-time pad messages this way is quite implausible. You have to somehow get a copy of a pad, and you have to intercept the messages that use the exact same pad to encipher. Even when these conditions are met, it is far from easy. You need to find out where each message starts and stops on the pad.

[sailor]

>> But key distribution is an important topic in cryptography, so saying it’s a “completely different” thing is not correct

Money is important to my eating but money is not food. Encryption and transmission are both important aspects of communication but one is not the other. They are completely different fields. Encryption is hiding information, whether you send it or keep it where you are, Transmission is sending information from point A to point B, whether the information is encrypted or not. Different things. A secure transmission channel does not equal data encryption in any way. It may make encryption unnecessary, but that does not mean it is the same thing.

Five centuries ago if I wanted to go to my cousin’s place to find out if the newborn was a boy or a girl, I would ride a horse to get me there and get the answer. After we both got telephones I merely called him and got the answer. The telephone may have obviated the need for the horse but the telephone is not a horse. At least I believe I can tell them apart. The same as I can tell the difference between data encryption and data transmission. The horse and the telephone were both useful in helping get information. Secure cryptography and secure transmission channels are both useful in keeping information secure. But one is not the other.