Encryption Key Policy in the 21^st Century

The proliferation of the Internet and computer systems has revolutionized communications, and has inherently introduced an abundance of new technologies, some out of necessity and some of convenience. With the ever-advancing world of computing and the subsequently advancing users of those systems, privacy has become a concern of paramount importance. More and more people around the globe have both the knowledge and technology to intercept private communications; encryption, or cryptography, is an increasingly logical solution to protect against privacy invasion. Even if people possess the tools needed to intercept communications, it is next to impossible to decipher a well-encrypted message. Privacy in communications holds its importance in all areas, from personal privacy guaranteed by the fourth amendment of the U.S. Constitution to privacy in business transactions. However, with the proliferation of encryption technology, governments, and more specifically law-enforcement agencies, seek to require universal avenues to recover encrypted messages, most often through some sort of ‘key recovery’ or ‘key escrow’ system. While key recovery is a novel idea, in practice it compromises the security of encrypted communications and interferes with personal and business privacy rights; laws prohibiting the creation of key recovery must be enacted to ensure the development of communications beyond the 21^st century.

Encryption is simply a mathematical way to scramble (encrypt) and unscramble (decrypt) digital information during transmission or for purposes of storage, and is used to protect not only personal communications, but also medical records, financial records, and increasingly, the intellectual property that businesses maintain on computer networks. A world without encryption for the Internet would be like a world without envelopes for letters, with every communication like a postcard (Barksdale 1). Public key encryption, invented by Diffie and Hellman in 1976, allows encryption without a secure link to exchange keys, and has become the basis for modern computer cryptography. In a public key system, users exchange their public keys and encode messages with the recipient’s public key. After receiving the encrypted message, a user decodes the message with his or her own private key. In this system, popularized by products such as Pretty Good Privacy (PGP), it is virtually impossible to deduce the private key from the public key, and the strength of the system depends on the number of bits in the key and the algorithm used. Modern public key encryption systems are generally regarded as unbreakable by present computer systems, and have become worldwide in usage. Public key encryption has solved the previously vexing problem of establishing a secure link to exchange keys, and is posed to become even more ubiquitous with new standards for public key directories that are in development.

Unfortunately, the development of public encryption technology has often faced enormous legal hurdles, with governments seeking to guard and prevent the dissemination of newer, more secure encryption technologies. Only recently have governments, including the United States, relaxed restrictions on the development and export of encryption technologies. Prior to January 14, 2000, the United States had a very restrictive policy on the export of U.S.-made encryption technologies, with restrictions placed on key length and algorithm type. Companies were placed in extremely disadvantageous positions because of their inability to implement and export technologies for secure global commerce and communications – "U.S. industry has been limited in how it can compete, because U.S.-based companies are not allowed to export anything stronger than 40-bit (or in some cases, 56-bit) encryption" (Barksdale). With the new export rules written by the Department of Commerce, U.S. encryption technologies are able to compete globally, but still only after a complicated process of government review.

After the new export regulations for encryption, there are essentially no current laws regarding encryption keys. However, governments have often offered concessions to further their anti-privacy agendas, as in the case of IBM and Lotus Notes. In 1996, IBM provided the U.S. government with the first 24 bits of its own encryption key, in exchange for the right to export a 64-bit security version of Lotus Notes (IBM). Although export regulations have been relaxed, governments will undoubtedly attempt to introduce new concessions to reduce the privacy of communications.

A major thrust by government agencies has been to require some sort of ‘key recovery’ or ‘key escrow’ system. Companies and/or users would be required to submit their keys to a trusted third party, so governments would be able to conduct covert surveillance within the changing environments brought about by new technologies (Abelson). Also, governments want ‘backdoors’ designed into encryption and security software, to allow covert access and near real-time access to data. These access requirements cross the lines of feasibility and greatly diminish the security of ‘secure systems.’ Economically, adding key recovery to most systems is a great additional cost in designing the system, with virtually no user demand for this feature (Abelson). Key recovery systems are important in some specific corporate situations, like protecting and ensuring access to data backup systems, but government proposals have generally focused on ubiquitous key recovery systems, where all types of secure communications include some variety of ‘backdoor’. For the end user, the only implications are added cost and diminished privacy and security. Another key feature of cryptography lies in the use of cryptographic techniques to make binding commitments, using ‘digital signatures.’ However, "some key recovery schemes are designed to archive authentication and signature keys along with confidentiality keys. Such schemes destroy the absolute non-repudiation property that makes binding commitments possible" (Abelson). As an important part of digital signatures, key certification authorities function as a trusted third party in online transactions, verify the validity of a public key, and hold no sensitive data. Government proposals for key recovery usually include some sort of key recovery agent, which holds private keys. If compromised, these key recovery agents could make available all the private keys of the users of that system.

The economics and practicality of key recovery systems make their implementation extremely difficult, but just as important are the civil rights of the encryption users. The U.S. Constitution states that "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated…" With covert access to all users’ private data, the rights of users would be in serious doubt. Additionally, there are new systems already implemented by the FBI which have the power to scan hundreds of thousands of internet and email connections in real time, in order to conduct surveillance. While the FBI’s stated intention is to use the massive scanning power to find an individual’s messages, all other communications would still be scanned in the process without warrants. If such a system were put in place, the only privacy protection users would have would be encryption. If the ‘carnivore’ or ‘omnivore’ systems were used along with government proposed key recovery standards, no communication could be private or secure.

Key recovery proposals often stem from law enforcement and intelligence agencies seeking to impose their current surveillance capabilities onto new technology. While this seems like an easy extension of existing capabilities, the nature of computer encryption and security technology do not warrant ‘backdoors’ because of their inherently secure nature. To establish this fact, in both 1997 and 1999 a bill was introduced in the House, the latest being H.R. 850, called the Security and Freedom through Encryption (SAFE) Act. Generally, the bill guarantees American the freedom to use encryption anywhere, and allows for more general and relaxed encryption sales and export rules. Also importantly, the SAFE Act specifies penalties for the willful use of encryption to conceal criminal evidence, but maintains that the use of encryption does not constitute probable cause (H.R. 850). Unfortunately, the bill never made it to a final vote, and a few weakening amendments were adopted in committees, including an amendment by the Armed Services Committee to give the president final authority over encryption exports and rules. Likewise, the 1997 version of the bill, H.R. 695, also died out in congress, but over the course of committee evaluation it received crippling amendments to limit freedom to use encryption.

Foes of strong encryption technology and law enforcement agencies seeking to limit privacy in the name of public safety are still determined to implement mandatory key recovery regulations. In addition to national encryption policy, "recent diplomatic initiatives by the United States government seeking European agreement to the "key escrow" system of cryptography masked intelligence collection requirements, and formed part of a long-term program which has undermined and continues to undermine the communications privacy of non-US nationals, including European governments, companies and citizens" (Campbell). Currently, comprehensive systems exist to access, intercept and process almost every important modern form of communications (Campbell). Without encryption, almost all communications are subject to surveillance around the globe.

To prevent possible new rules restricting the use of encryption technology and requiring key recovery, legislation must be introduced prohibiting mandatory key recovery. A bill and possibly an international encryption policy agreement, much like the SAFE bills introduced in the house, must be fashioned and passed to ensure secure and private communications throughout the 21^st century. Such a bill must include several provisions, including the freedom to use and develop encryption technologies, protection specifying that the use of encryption does not constitute probable cause of a crime, and, most importantly, the prohibition of mandatory key recovery.

With global life and economies now relying largely on the internet and computer systems, the security and privacy of those systems are crucial to the sustenance of worldwide communications. Encryption technology successfully addresses those security needs, and the freedom to use encryption is an important civil right and economic necessity. Legislation to prevent mandatory key recovery would guarantee the civil rights of individuals and the economic stability of corporations for years to come.

Abelson, Hal. "The Risks of Key Recovery, Key Escrow, and Trusted Third Party Encryption"

1. Center for Democracy and Technology. 24 April 2001.

Campbell, Duncan. "Interception Capabilities 2000"

April 1999. Director General for Research of the European Parliament. 24 April 2001.

http://www.cyber-rights.org/interception/stoa/interception_capabilities_2000.htm

Barksdale, Jim. "Strong Encryption: Key to the Internet Economy"

15 Oct. 1997. Wall Street Journal, 26 Sep. 1997. 24 April 2001.

http://home.netscape.com/columns/mainthing/wsj2.html

"IBM to Provide Lotus Notes Encryption Key to U.S. Government"

14 Feb. 1996. Wall Street Journal, 18 Jan. 1996. p. B7. 24 April 2001.

http://www.ieee-security.org/Cipher/Newsbriefs/1996/960214.lotuskeys.html

United States. Goodlatte. H.R. 850

106^th Congress, 1^st Session. Washington: GPO 1999. 24 April 2001.

http://www.cdt.org/legislation/106th/encryption/safe.pdf