From: smb@research.att.com
Date: Wed, 10 Nov 93 08:53:57 PST
To: perobich@ingr.com
Subject: Re: Ever buy encryption software? YOU WILL!
Message-ID: <9311101653.AA08623@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


	 -----BEGIN PGP SIGNED MESSAGE-----

	 I found this on comp.dcom.telecom and have elided some marketing
	 material. My editorial comments are enclosed in brackets.

	 Amazing. _AT&T_, the same folks that were trying to bring us Clipper,
	 are going to sell DES over-the-counter. I'd be happier with
	 triple-DES, but this blows my tiny little mind.

Disclaimer:  I'm speaking for myself, not AT&T.

I've said this before, but it's worth repeating.  For the most part,
corporations exist to make money.  They don't take moral stances.
(Aside:  I'm not saying that this is good or bad; rather, I'm saying
that it just is.)  If you offer a company a way to make money, it
will probably do it.  Unified visions, of the sort you're implying
AT&T had on encryption, are generally seen as long-term ways to make
money, i.e., if the company picks some standard, it will be easier or
cheaper to make or sell some future set of products.

In the case of Clipper, there was a clear market:  the government wanted
to buy Clipperphones.  AT&T already sells secure phones (STU-III's) to
the government; the question here (and I wasn't privy to any of the
discussions) was whether or not it would cost more to develop the phone
than the potential profits.

But Clipper isn't, and can't be, the be-all for encryption, even apart
from the moral questions.  See if you can dig up AT&T's response to the
proposed key escrow FIPS.  I suspect you'd be surprised.  I don't think
I have it handy, but it points out things like the unsuitability of
key escrow for software implementations -- and the products you describe
are exactly that.  Yes, AT&T as a company thinks that there is a market
for privacy devices.  (And it's no secret that the defense market is
drying up, due to budget cuts.)  Clipper can't fill certain market niches.
DES -- or triple DES, or IDEA, or RC2, or whatever -- can.