No master keys for me, thank you With last week's disclosure of a serious loophole in some versions of the Pretty Good Privacy encryption software, I'm fighting the temptation to say that I told you so. I'm losing the fight. By Peter Coffee I haven't been warning people away from using PGP . Strong encryption, enabling trusted transactions between previously unknown parties using standards-based public networks, is the foundation of all future growth in electronic commerce. Containing crypto will do much more harm than good, and public safety alarmists should get a grip on the notion of risk versus benefit.
Criminals also drive cars.
The basic unworkability of key escrow is examined at great length in a paper by a distinguished team of crypto experts , but the essence of my argument can be expressed in far fewer words. When I'm going out of town for weeks at a time , I leave a key with a trusted neighbor who brings in the mail and who looks for signs of anything untoward. I don't tell the postal service that I'm leaving, and I don't leave a key with the local police. Key escrow proponents try to dress up this odd notion with earnest professions of concern for due process of law, and with promises that only court-ordered disclosure will let my cryptographic keys be used against me. As it happens , I don't have anything to hide, because I'm used to the idea that anything I write may come back with a demand for justification-sometimes years after I wrote it.