Path: cantaloupe.srv.cs.cmu.edu!das-news.harvard.edu!noc.near.net!howland.reston.ans.net!bogus.sura.net!udel!news.intercon.com!usenet
From: amanda@intercon.com (Amanda Walker)
Newsgroups: sci.crypt
Subject: Re: Secret algorithm [Re: Clipper Chip and crypto key-escrow]
Date: Mon, 19 Apr 1993 11:40:38 -0500
Organization: InterCon Systems Corporation - Herndon, VA  USA
Lines: 61
Distribution: world
Message-ID: <1quhao$ek3@news.intercon.com>
References: <PMETZGER.93Apr18141006@snark.shearson.com>
Reply-To: amanda@intercon.com (Amanda Walker)
NNTP-Posting-Host: chaos.intercon.com
X-Newsreader: InterCon TCP/Connect II 1.1

pmetzger@snark.shearson.com (Perry E. Metzger) writes:
> I'm a political dissident. I'm scared shitless of the feds listening in 
> on my calls. My opinions are the sort that would get me 
> "disappeared" in a slightly less free society -- and who knows what 
> sort of society we will be in in five or ten years? I have friends who 
> have had their phones tapped -- none of this is theoretical to me. 

I understand, believe it or not, and there are any number of kinds of 
conversation and communication I engage in that I wouldn't even consider 
using this scheme for.  On the other hand, I don't see "Clipper" as providing 
a secure channel--it just prevents casual eavesdropping.  This is part of why 
I am not worried about it per se.  Trying to look at Clipper as a serious 
security tool is simply ludicrous.  It's a voice scrambler, nothing more.

There is still plenty of market for real crypto.

> As for "its better than the status quo", well, first of all, you can 
> get a cryptophone from companies like Cylink today -- and they work 
> well.

They cost an arm and a leg, though. "Clipper" is obviously aimed at the mass 
market.  It certainly won't put Cylink out of business.

> In addition, a number of groups are now working on building 
> software to turn any PC into a privacy enhanced phone right now -- and 
> they are all working in overdrive mode. 

This is old news.  I can do this now.

> There ARE no crypto restrictions... yet. You can use anything you want 
> RIGHT NOW. The point is to maintain that right. 

There ARE restrictions.  Example: We're a networking software vendor with a 
large overseas share of our market.  We cannot currently ship PEM, or even 
simple DES, in our products without case-by-case approval from the Department 
of State.  ITAR presents a material trade barrier to US firms trying to 
compete in international information systems markets.

Sure, you can use whatever freebie software you want to talk over BBS's in 
the USA.  I, on the other hand, want strong crypto (PKCS, for example) to be 
the *default* for electronic mail, worldwide.  I want priests to be able to 
hear confession over email.  I want lawyers to be able to talk to clients in 
confidence over email, or doctors talk with patients.  I want to be able to 
order products from my favorite Japanese mail-order catalog over the net.  I 
want to be able to sign contracts, transact business, and so on 
electronically.

This is so far infeasible as a result of the current restrictions on 
crytographic systems, especially beyond the borders of the USA.

Clipper is irrelevant, and if it distracts the authorities into feeling safe, 
all the better.  Its only danger is if it emboldens them into trying to put 
more restrictions into place, on the theory that it is "good enough for 
anyone who has nothing to hide."  That argument is, of course, utter BS, just 
as much as "no one needs an assault rifle".


Amanda Walker
InterCon Systems Corporation


