From: jya@pipeline.com (John Young)
To: cypherpunks@toad.com
Message Hash: 8a65036492aff305bae185425a185d67ce248e9782ae96a9b9d6e9ac5c5310b8
Message ID: <199610041740.RAA19910@pipe1.ny2.usa.pipeline.com>
Reply To: N/A
UTC Datetime: 1996-10-05 01:53:19 UTC
Raw Date: Sat, 5 Oct 1996 09:53:19 +0800
From: jya@pipeline.com (John Young)
Date: Sat, 5 Oct 1996 09:53:19 +0800
To: cypherpunks@toad.com
Subject: ABA Likes GAK
Message-ID: <199610041740.RAA19910@pipe1.ny2.usa.pipeline.com>
MIME-Version: 1.0
Content-Type: text/plain
10-03-96 at 19:09 EDT, American Banker
Banks Like Export Plan for High-Power Encryption
By Drew Clark
-----
"Banks have really taken a leadership role in the
responsible management of cryptography," said a senior
Clinton administration official who asked not to be
named. "Banks are already doing what we want other
organizations to do: safeguarding their keys and
providing them, when necessary, to law enforcement."
"Providing 56-bit encryption with key recovery doesn't
help us," said Netscape spokeswoman Chris Holton. "The
government is saying that you can export it but you have
to provide us with the keys. We feel that is extortion on
the part of the government."
"We are making the best of a bad situation," said Scott
Schnell, vice president of marketing for RSA Data
Security.
-----
Bank technology experts have reacted favorably to the
Clinton administration's proposal to liberalize the
development and sale of strong data security tools.
This week, the government said it would lift export
restrictions on certain kinds of cryptography, provided
U.S. companies agree to cooperate with a procedure that
would give law enforcement officials access to the "keys"
of such codes, upon presentation of a warrant.
Banks were heartened by the announcement because many
view the widely used Data Encryption Standard - a
low-level form of data scrambling - as inadequate
protection against the rising computer power of so-called
hackers.
Though banks can use a complex 56-bit data encryption key
for financial transactions, sensitive communications with
overseas branches are limited to a less powerful 40-bit
standard.
Banks hope that a loosening of restrictions in general
will benefit them, too.
"This policy announcement is better than anyone
expected," said Kawika M. Daguio, federal representative
at the American Bankers Association in Washington. "It is
gravy for us, but it's the meat and potatoes for the
hardware and software industries."
"Banks probably won't be adversely affected," said
Stewart A. Baker, a partner at Steptoe & Johnson, a
Washington law firm, "and they will be left pretty much
where they were before."
The announcement by Vice President Al Gore said that
controls over powerful encryption technology would be
lifted as the government and private sector develop a
"key recovery" system. (International Business Machines
Corp. already has stepped forward to head a consortium
dedicated to creating such a system.)
Current law forbids the export of computer hardware or
software that uses cryptographic codes with digital
"keys" - randomly generated combinations of 0's and 1's -
longer than 40 bits. The longer the key length, the more
impenetrable the code.
For three years, the government has said it would permit
the general use of more complex cryptography only if the
companies using it placed their keys in the hands of the
government or a third party.
"Key escrow," as it is known in the technical community,
is needed in order to prosecute people who have stored
evidence of illegal activity on the hard drive of a
computer, officials argued.
But the private sector - banks included - have balked at
handing over such access to any third party.
The disagreement gave rise to a compromise system known
as "key recovery" in which companies would hold their own
keys but could be required to divulge certain information
about specific transactions when presented with a court
order or warrant.
"What is novel is that it doesn't escrow any keys," said
Homayoon Tajalli, executive vice president of Trusted
Information Systems, Glenwood, Md., one of IBM's
consortium partners.
"If the government comes and gets this data with a court
order," explained Mr. Tajalli, "then they take a digital
lockbox from the third party or parties that hold it, and
they read the message."
Kathy Kincaid, director of information technology for
IBM, said the difference between key escrow and key
recovery is analogous to the following approach to
securing a house when its owner goes on vacation: Instead
of giving a key to two neighbors, the owner gives each
neighbor half the combination to a lockbox that holds the
key.
"You must have both halves and put them together in
exactly the right sequence," said Ms. Kincaid. "This
provides protection against a single point of attack."
Companies participating in development of key recovery
systems include: Apple Computer Inc., Digital Equipment
Corp., Groupe Bull, Hewlett-Packard Co., NCR Corp., RSA
Data Security, Sun Microsystems Inc., Trusted Information
Systems, and United Parcel Service.
And a government official said banks may even play a
role.
"Banks have really taken a leadership role in the
responsible management of cryptography," said a senior
Clinton administration official who asked not to be
named. "Banks are already doing what we want other
organizations to do: safeguarding their keys and
providing them, when necessary, to law enforcement."
Heidi Kukis, a spokeswoman for Vice President Gore, said:
"This key recovery system is the proper balance between
commercial interests and national security."
But not all agree. Some argue that the key recovery
system still gives the government too much control over
information flow.
"Providing 56-bit encryption with key recovery doesn't
help us," said Netscape spokeswoman Chris Holton. "The
government is saying that you can export it but you have
to provide us with the keys. We feel that is extortion on
the part of the government."
"We are making the best of a bad situation," said Scott
Schnell, vice president of marketing for RSA Data
Security.
"The bottom line is that the standard proposed by the
government is an insubstantial step in the right
direction," he said. "We want to make sure it is usable
and prepare for the day that products will be available
that do not have this key recovery situation."
The government's announcement came three months after a
National Research Council report on the role of
cryptography in an information-oriented society.
The report encouraged liberalization of government
standards and questioned the feasibility of the key
escrow system then favored by government.
"We raised the issue about the security of key escrow
systems," said law professor Kenneth W. Dam, chairman of
the body that prepared the report, "and we said the
government should work on it."
"I take it this is an attempt to move in the way of key
escrow, with the help of industry," said Mr. Dam.
[End]
Return to October 1996
Return to “jya@pipeline.com (John Young)”
1996-10-05 (Sat, 5 Oct 1996 09:53:19 +0800) - ABA Likes GAK - jya@pipeline.com (John Young)