Date:  Mon, 2 Nov 92 23:39:31 EST
From:  Brinton Cooper <abc@brl.mil>
Newsgroups: comp.society.privacy
Subject:  Re: 15th National Computer Security Conference 
Organization:  The US Army Research Laboratory
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 096, Message 3 of 8


[Moderator's Note:  The following is a letter from Dorothy Denning to
RISKS DIGEST and Brint's reply.   ._dennis]

  Date: Tue, 27 Oct 92 08:55:33 EST
  From: denning@cs.cosc.georgetown.edu (Dorothy Denning )
  Subject: Re: 15th National Computer Security Conference in RISKS DIGEST 13.87

In response to my earlier message about registering encryption keys, some
people have asked how can I be sure that criminals won't use non-registered
keys.  I don't have a foolproof answer, but consider phone calls.  Most people
who want to encrypt will buy a commercial product with a built-in key.  The key
could be registered when the product is bought.  Yes there could be a black
market in non-compliant products, and the likelihood of that increases every
day that we fail to take action on this issue.

Peter Boucher also asked about the benefits of registering keys with a federal
agency.  After discussing this problem with law enforcement officials and
criminologists, I am convinced we are facing a potential crisis in law
enforcement if we lose the capability to conduct court authorized taps.  The
economic value alone of conducting lawful electronic surveillance is estimated
in the billions.  Much of this is related to organized crime.

Larry Hunter asked how can we be sure that the key centers won't collude with
the Department of Justice and give out the key.  If the relationship between
the phone companies and DOJ is any indication, this won't happen.  The folks at
the phone companies are so fussy about court orders that they send them back if
the semicolons aren't right.  And don't forget that even if the key center
(which I envisioned as a non-governmental agency) and DOJ collude, they still
need to get the bit stream from the phone companies.  But if this doesn't
satisfy you, Silvio Micali has an even tighter scheme that would allow your
private key to be broken up into five piece and shared with 5 trustees.  All
five pieces would be needed to restore the key, but the pieces could be
verified as allowing proper restoration without the need to actually put them
together.  He calls this "fair public-key cryptosystems."
                                                            Dorothy Denning

Brint's Reply:

  Date:     Mon, 2 Nov 92 23:38:32 EST
  From:     Brinton Cooper  <abc@brl.mil>
  To:       denning@cs.cosc.georgetown.edu
  Subject:    15th National Computer Security Conference 


In Risks-digest, you write (in part):


 . ...I am convinced we are facing a potential crisis in law
 . enforcement if we lose the capability to conduct court authorized taps.  The
 . economic value alone of conducting lawful electronic surveillance is estimated
 . in the billions.  Much of this is related to organized crime.
 . 
 . Larry Hunter asked how can we be sure that the key centers won't collude
 . with the Department of Justice and give out the key.  If the
 . relationship between the phone companies and DOJ is any indication, this
 . won't happen.  The folks at the phone companies are so fussy about court
 . orders that they send them back if the semicolons aren't right.  And
 . don't forget that even if the key center (which I envisioned as a
 . non-governmental agency) and DOJ collude, they still need to get the bit
 . stream from the phone companies.  But if this doesn't satisfy you,
 . Silvio Micali has an even tighter scheme that would allow your private
 . key to be broken up into five piece and shared with 5 trustees.  All
 . five pieces would be needed to restore the key, but the pieces could be
 . verified as allowing proper restoration without the need to actually put
 . them together.  He calls this "fair public-key cryptosystems."

First, I should hate to think that my right to safety from illegal
search and seizure and/or illegal eavesdropping on my telephone
conversations rested on the good will and integrity of a phone company!

Second, it's difficult to envision a non-governmental agency, created by
the government but not really government.  The Post Office purports to
be a non-governmental agency but isn't.  It's employees still look and
act like US Civil Servants, and the P.O. can easily conduct a "mail
cover" for a governmental agency without a court order.

You must remember that court orders, search warrants, and the like are
useful only when the information or evidence gathered under their aegis
is to be used in court against a suspect.  If information is being
gathered for political purposes, to blackmail someone, or to subvert the
law (Watergate, Iran-Contra, the Italian bank, etc), the information
will never see a public forum.  Thus, the constraints of court orders
are obviated.

The FBI needs to fund its own R&D out of its budgetary resources, just
as the rest of the government at all levels must do.  There is talent
that can "red team" modern telecommunications and find trapdoors when
necessary.

You must never forget that the gravest threat to our freedom is, and
always has been, government itself.  

_Brinton Cooper