News.com: Crypto Doesn't Kill - People Do 259
McSpew writes: "Bravo to News.com for telling the truth about cryptography. They even cited /.'s coverage of Phil Zimmerman's real views on PGP and its possible role in any terrorist acts." On a per-word basis, this may be the best summary of why calls to ban or restrict encryption technology (as with government key escrow, or constrained key sizes) has little to do with enhancing national or world security.
Its too easy to circumvent restrictions (Score:3, Insightful)
one-time pads (Score:5, Insightful)
The one-time pad is a very easy cipher to explain to lay people. They need no understanding of math, not even arithmetic.
Anybody, anywhere can create a one-time pad by simply flipping a coin or rolling the dice, and use the resulting information to encrypt a message that is impervious to all manners of cryptoanalysis, even techniques made possible by the much-feared though yet-to-be-stocked quantum computer.
In other words, you can create a encrypted message without encryption software or even a computer, and yet be assured that the message is unreadable by any computer devisable today or anytime in the future.
There should be no debate here. Military-grade cryptography is available to anyone with a penny in their pocket and a sheet of paper and pencil.
We need to stop wasting time talking about this.
Crypto Kills (Score:5, Insightful)
Now you know what all the gun nuts were talking about.
It's already been done wth handguns - I figured all guns were next, but looks like crypto is next.
crypto backdoors (likely) == hurt the us economy (Score:3, Insightful)
(This coming from a geek trying to put it in a language that many marketers, politicians, economists, etc could understand, who actually dislikes most businesses today.)
Who will it hurt? (Score:3, Insightful)
what better priorities? (Score:2, Insightful)
What about the priority of preserving through logic and appeals to legitimate and justified self-interest the freedoms terrorists would like to destroy with their intimidation attacks? That one suits me.
Re:one-time pads (Score:2, Insightful)
Yes, and then you'd need to securely transmit that one-time pad to the person receiving your message. You still haven't solved the Catch 22 here.
Albeit, quantum crypto can solve this. Despite the fancy name, it's nothing more than a secure way to transmit regular encryption keys. It's just not practical at the moment. And large messages with one-time pads? The key would be as big as the original message. Thank you, but for regular use I'd choose good block ciphers any day.
Re:one-time pads (Score:2, Insightful)
It may not be an ideal manner of encrypting your data, but it is one that will always be with us, regardless of what we do.
The point is to find a way of explaining to lay people that any controls they want to place on cryptography are pointless.
For terrorists, the one-time pad is more than suitable.
Re:Crypto Kills (Score:2, Insightful)
Guns are used in a variety of SPORTS (target shooting being a classic example). The purpose of a gun is determined by the shooter. Just like the purpose of crypto.
Before people start whining about their rights and freedom of , they should contimplate what freedom actually means and how it affects everyone. It's pretty amusing to read the posts here on
Guns may be instruments of death to some people, but they are a hobby to others. It depends on the person holding the gun. Crypto should be viewed in the same way.
He's missed the point (Score:5, Insightful)
Anyone using encryption stands out; so they write a file on them.
Where they find encrypted data they can't characterise it any further; so they hit a brick wall. But its not common right now, so they can make a file. However, if everyone on the internet routinely uses uncrackable encryption they can't build a file on everyone.
On the other hand, if they have key escrow they can blow away the encryption on all the legitimate data and they are left with 'illegal' encryption; except presumably terrorists and other malcontents; a much smaller group that they can write files on.
Of course this 'monitor all the traffic on the internet idea' falls down in several other ways. As an example, suppose somebody creates a Quake III server that has some sort of low bandwidth messaging in it perhaps the player steps left at careful timed moments or something, the characterisation by the NSA would be, oh its just another Quake player, when really its sending an encrypted message as well. [I just made that Quake idea up- its called 'steganography' in general, hiding encrypted messages in something else.]
Anyway, that's really what's going on. The security agencies are using the WTC disaster as a chance to get their legislation through whilst the going is good. Of course anyone with any sense can evade it, but not every terrorist has sense.
Even ClearText email can be used for a bad purpose (Score:2, Insightful)
Let's meet at 7:45 in front of the Arthur Anderson school on the 11th
Translation: You will overtake American Airlines flight 745 on the 11th
That would look totally benign, yet be the actual trigger to the event. No crypto needed!
Re:Crypto Kills (Score:2, Insightful)
I don't want crypto banned/regulated. My point was pretty simple: we should be defending all freedoms, not just those that affect our personal interests. The gun issue just highlights the hypocrisy flying around this country.
I am just as paranoid about a police state as the next geek. But I also have the ability to look objectively at any given situation.
Re:Are you a troll? (Score:1, Insightful)
Re:one-time pads (Score:5, Insightful)
This is not such a good idea. A one time pad is to be used once, and that means you certainly can't repeat it within a single message. Therefore, each message would have to contain a one time pad that was large enough to encrypt the whole of the next message, including the one time pad in that, and so on. Obviously this means your messages will get shorter and shorter!
Re:one-time pads (Score:5, Insightful)
Re:He's missed the point (Score:4, Insightful)
On the other hand, if they have key escrow they can blow away the encryption on all the legitimate data and they are left with 'illegal' encryption; except presumably terrorists and other malcontents; a much smaller group that they can write files on.
You already note one good way of getting past this: stenography, hiding the message in something that looks legitimate. (Your low-bandwidth Quake motion idea was a good one.) There is another: nested encryption. Presumably, unless somebody is already suspected, the monitoring agencies aren't going to be allowed to read the contents of all of this mail and so forth without a warrant. (Yeah, yeah, I know, I'm being foolish, but bear with me.) As such, all they will be able to do is verify that the message is encrypted with a legal, escrow-available key.
So somebody wanting to use illegal encryption encrypts their message with their own crypto, and then encryptes that ciphertext with legal crypto. It will pass the sniffer, but will still be unreadable if somebody gets a warrant and uses the escrowed key on the outer crypto. It won't do the statistical guys any good since their statistics pass will say that these people are using the legal crypto just like everybody else.
As has been noted elsewhere, trying to put controls and limits on this sort of thing is completely quixotic. The only thing which is going to make people copy is a desire to be compliant with the laws. As such, the only people that the laws hinder and restrict are the law-abiding citiziens that (theoretically) the laws aren't directed at. There are two possible motivations for these laws: one, a real misunderstanding of how quixotic trying to regulate crypto would really be. Or, two, a much more sinister desire to get the mechanism in place to monitor every citizen. Choose which motivation you think is behind all of this based on your own level of paranoia and how cynical you are about how naive our leaders are vs. how sinister they are.
-Rob
Re:Are you a troll? (Score:3, Insightful)
(Sheesh! You'd think 11-SEP would have taught people this!)
Close, but not quite.... (Score:5, Insightful)
The full underlying cause of this is nationalism and the belief that the State is an almost divine entity that will protect you from all ills provided you play by its rules.
History shows that this is a fool's bargain. Any state--and yes, flag-wavers, that includes the US--is *designed* to limit your freedoms for the "greater good". While this works for a great many people indoctrinated to accept the definitions the State provides for "freedom" and "democracy", it is not, nor has it ever been, a complete solution for people in the world, and *much* has been done in the name of the State--like much was done in the name of God before it--that is simply hateful and evil.
Allegiance to the State, a belief that the State is all, that you should be proud to be part of the State, happened in Germany in the 1930s, and it appears to be happening here. Based on some of the troll posts here, you just have to substitute Arab for Jew, and you have the basic plank of the Nazi party flying in full colors.
How does this relate to crypto? It doesn't really at all--that's the point. But, if we're really trying to make a connection, then there's the tenuous observation that crypto is math, and knows no allegiance to State, which has no allegiance to you, meaning that Crypto is like the State in that it is an abstract concept without any feeling or allegiance to anyone or anything. The major difference between Crypto and the State is that the State is established, has full access to social control mechanisms, and panders to people's senses of belonging while Crypto is simply math that individuals can use to keep pieces of themselves from the State and unto themselves.
It is natural that the State--which *fully* seeks the totality of National Socialism, and now has the capacity to make _1984_ look like a Disneyland ride--would seek to abolish the one tool that can put an individual on equal footing with it. It's up to *us* to drop our allegiance to one abstract concept and rally our efforts around the other.
I'll leave it up to you to decide which way the wind appears to be blowing.
Re:Crypto Kills (Score:2, Insightful)
Gee, I get tired of hearing that myth-- that guns are more "freely available" now than ever before and that's why we have violence in schools that would have been unimaginable 40 years ago.
The truth is that guns are far less available than they were then. When I was a kid in the late 50s and early 60s (yeah, I'm older'n'dirt) you could buy a surplus military rifle from an ad in the back of a comic book, for the huge sum of $15. The postman would deliver it to your house, no questions asked.
And now you can't even buy a gun mail-order unless you have a federal license. There are background checks, and a thicket of laws attempting to reduce gun ownership and restrict access to guns. And yet somehow the violence is worse than it was when guns were really "freely available." How does that scan?
I expect the same sort of reverse results curve when good crypto is outlawed. Law-abiding citizens won't be able to use it for their own protection, but criminals and whackos will use it to prey on the rest of us.
SSH is a better battleground than PGP (Score:3, Insightful)
As far as I can see, *email* encryption really is what the general media and the politicians do think the argument is all about. Because so far only a small fringe minority use encrypted email, the pols think it will hardly be missed; and besides, the obsessive secrecy probably indicates that the users are up to no good anyway.
The idea of *channel* encryption probably doesn't even cross their radar. But 'alienmole' is absolutely right: the most widespread and important use of encryption at the moment is *not* email; it is the use of ssh and friends to secure public channels. And the reason these are so important is obvious -- and probably much easier to explain to the public -- in these days of crackers and virus writers: you really don't want anyone to be able to break into your channel, and interfere with your remotely-controlled telescope or heart operation or hack into your corporate network or whatever.
The case for SSH is much easier to make than the case for PGP, because of its demonstrable real-world importance. If we can move the debate towards channel security, away from email security, it will be much easier to win.
But of course as soon as two people can ssh into the same box and talk to each other, the banning of any other uses of encryption starts to look pretty irrelevant.