From: "L. Detweiler" <ld231782@longs.lance.colostate.edu>
Date: Fri, 6 Aug 93 23:13:56 PDT
To: cypherpunks@toad.com
Subject: NSA SAYS: NO LIMIT ON ENCRYPTION
Message-ID: <9308070611.AA11855@longs.lance.colostate.edu>
MIME-Version: 1.0
Content-Type: text/plain


From EFF Online V 5. No 14 8/5/93, official response on EFF Clipper
questions--a MINDBOGGLER!

>Because these measures may be
>sufficient to make key escrow encryption the easiest and most available
>privacy protection it would be imprudent to pursue the far more drastic
>step of regulating private encryption.  

`drastic'? `imprudent'? this from the NSA?

>The Administration has progressed
>far enough in its review to conclude it will not propose new legislation to
>limit use of encryption technology.

GOOD LORD! HALLELUJA! VICTORY!

(Is that a typo?! Did they mean `not far enough'? That's what I
*thought* they said at first!)
(uh, if this is right, can we get that in writing? with D. Denning's signature?)

BTW, This paragraph is almost incoherent and has another typo. Did NSA
have a hangover when they wrote this? Or were they drunk?

* * *

Other notes:

>Enhancing the government's ability to decrypt non-key escrow encryption
>used by the targets of authorized law enforcement wiretaps is another
>possible strategy for coping with the effects of encryption on law
>enforcement.  However, since encryption appears in a number of forms and
>applications, the costs are likely to be substantial and may not be either
>affordable or practical given the requirement for "real time" decryption in
>the course of wiretap operations.

This is the `give the NSA more money for research' argument, and is
infeasible not solely because of `a number of forms of encryption and
applications' but because of the underlying *security* of the emerging schemes.

Also in this they specifically address the question of whether Key
Escrow is legal within constitutional rights. Here they are so bold as
to suggest the 4th amendment is *strengthened* because only `legally
lawfully authorized' (their three most favorite words) taps can be
installed. Interesting, I wonder how our esteemed forefathers would
react to this unique interpretation of their masterpiece.

But as long as Skipjack is voluntary this begs the question. The
fundamental question: is *mandatory* or *restricted* use unconstitutional?

Also, we have the first official written admission that `criminals' may
turn to other schemes or `double encrypt' (i.e. encrypt the data into the system).

===cut=here===

Date: Fri, 6 Aug 1993 10:34:22 +0900
From: farber@central.cis.upenn.edu (David Farber)
Subject: EFFector Online 5.14

[...]

****************************
Answers to Clipper Questions
****************************
In a previous EFFector Online, we printed some of the 114 questions sent to
President Clinton by the Digital Privacy & Security Working Group on the
Clipper Chip.  On July 29, we received a response to these questions from
John D. Podesta, Assistant to the President and Staff Secretary.  Some
highlights of the response follow.  The complete text of the response will
be posted to EFF's ftp site.

Why is key escrow being proposed?

The development of key escrow encryption technology was born out of a
recognition on the part of the U.S. Government of the public's growing
desire for high quality encryption capability for commercial and private
use.  At the same time, the Government was concerned that the widespread
use of this technology could make lawfully authorized electronic
surveillance much more difficult.  Historically, law enforcement
encountered very little encryption, owing largely to the expense and
difficulty in using such technology.  With growing availability of lower
cost, commercial encryption technology for use by U.S. industry and private
citizens, it became clear that a strategy was needed that could accommodate
the needs of the private sector for top notch communications security; of
U.S. industry to remain competitive in the world's secure communications
market; and of U.S. law enforcement to conduct lawfully-authorized
electronic surveillance.

Enhancing the government's ability to decrypt non-key escrow encryption
used by the targets of authorized law enforcement wiretaps is another
possible strategy for coping with the effects of encryption on law
enforcement.  However, since encryption appears in a number of forms and
applications, the costs are likely to be substantial and may not be either
affordable or practical given the requirement for "real time" decryption in
the course of wiretap operations.

Why is the algorithm classified?

A classified algorithm is essential to the effectiveness of the key escrow
solution.  The use of a classified algorithm assures no one can use the
algorithm in non-escrowed systems.  Also, disclosure of the algorithm
would, in effect, provide the world with an extremely secure encryption
capability that could be implemented and used in systems by those whose
interests are adverse to U.S. national security interests.  Finally, NSA
classifies all of the algorithms used for defense systems as part of its
policy to take all reasonable steps to assure the security of systems it
develops.  The algorithm was classified in accordance with Executive Order
12356 and its implementing regulations.

For all these reasons the encryption algorithm could not be chosen from
those already available to the public, such as the Data Encryption Standard
(DES).  Similarly, the algorithm cannot be published for public review and
comment.  Nonetheless, in keeping with the Presidential Decision Directive
of April to allow independent experts to review the integrity of the
classified algorithm, five such experts have already begun a study of the
algorithm.  We expect their findings to be made public soon.

Is the key escrow initiative compatible with constitutional rights?

Questions have been raised whether the requirement of key disclosure
infringes upon one's right to free speech under the First Amendment, the
right against self incrimination contained in the Fifth Amendment, or the
right against improper search and seizure in the Fourth Amendment.  The key
escrow scheme does not require the owner or user of a device equipped with
the key escrow encryption chip to say or produce anything.  The key escrow
technique in no way addresses the issue of what people may choose to say,
and the individual user of key escrow products will not be required to
provide the government any information.  Indeed, the individual will not
know the keys.  Thus, this technology or technique in no way impacts the
rights available under the First or Fifth Amendments.

Law enforcement organizations will not be able to decrypt communications
without the device unique key and they can only obtain the key components
needed to determine a device unique key after making an appropriate
certification of their authority to conduct electronic surveillance to the
independent key escrow agents.  Thus, this technology actually strengthens
the Fourth Amendment protections afforded individuals, since law
enforcement cannot obtain the contents of communications without first
obtaining the key component.

Will use of the key escrow technology be required?

One point clearly stated in the Presidential Decision Directive and
emphasized several times since April is that use of key escrow encryption
technology is voluntary.  While the U.S. government encourages its use
because of the excellent security it provides, and will promulgate
standards permitting its use by government departments and agencies, there
is no requirement that the public use it.  No doubt some, particularly
those intent on thwarting authorized wiretaps, will buy other forms of
encryption or could "double encrypt" their communications suing a key
escrow device in combination with a non-escrowed device.  But we believe
the vast majority will buy this system because it is easy to use, provides
superb security, and likely will be readily available in commercial
products.

The Administration has chosen to encourage the widespread use of key escrow
devices rather than mandating or regulating its use.  Though we recognize
the risks to law enforcement activities posed by the widespread use of
sophisticated encryption products, we also recognize that encryption is an
effective means to secure communications and computer systems.  Thus far,
government purchases and standards have created secure products that sere
bought by private citizens "piggybacking" on the government's development
effort.  It makes little sense for the government to promulgate standards
or to develop products that will defeat law enforcement interests if and
when they spread to the private sector.  Because these measures may be
sufficient to make key escrow encryption the easiest and most available
privacy protection it would be imprudent to pursue the far more drastic
step of regulating private encryption.  The Administration has progressed
far enough in its review to conclude it will not propose new legislation to
limit use of encryption technology.