NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/sci/crypt/5040

Text File | 1992-11-19 | 5.9 KB | 117 lines

Newsgroups: sci.crypt
Path: sparky!uunet!think.com!mintaka.lcs.mit.edu!knight
From: [e-mail] (Nighty Knight)
Subject: Anti-Encryption Laws are none too bright.
Message-ID: <[e-mail]>
Sender: [e-mail]
Organization: Free Software Foundation
Date: Thu, 19 Nov 1992 23:43:04 GMT
Lines: 106

     Recently, there has been quite a bit of debate on this newsgroup
as to the morals and considerations against allowing Public Key into
the world society.  People have been proposing laws against it, and
giving out examples that are quite paranoia inducing (such as
Mr. Ritter's child pornographer example.)

     My own viewpoint is somewhat tainted toward patching holes which
exist currently with common, every day computer usage -- I started
gaining interest in cryptography and application programming with
encryptions out of necessity to everyday security issues.

     Let me try to express my point of view to the public in such a
way as encryption not only makes sense -- but very good sense.
Furthermore, I can't help but feel that the government is going to
shoot themselves in the foot (or possibly a more vital organ) by
outlawing public key.

     I've discovered a large number of backdoors placed in computer
software, programs which are trusted by banks, large businesses,
investors, and the like.  These holes were placed in these programs
in such a way as anyone who used them could gain supervisor, root,
sys_adm, or otherwise super-user rights.

     Whenever I discover these, I let the channel deal with them.
Most of the time "copy protection" is the excuse I get back, and for
people running PC networks, I can understand the worry makers of
business software have with the programs they distribute.  Having an
entire network of pirated software is basically more painful then
a single home copy.  They need some way to identify the person who
invalided the license agreement, and that way is through super-user.

     Copy Protection in this regard makes most software purchased
a liability to security.  If placing backdoors in software were
deemed illegal, then part of the necessity of encryption would go
away.  But since a backdoor is hidden to all but the trained,
experienced eye, they might be unnoticed for long periods or maybe
even never.  They could also argue it was a "bug" and not deliberately
placed in thier code.  Regardless, I've seen too many examples of
how backdoors could be triggered to know that any law prohibiting
them could be effectively "sidestepped"..

     Encryption is necessary to keep private material truely private.
Even if a person gets super-user on your computer, e-mail would be
safe, documents would be safe, and transaction records would be safe
(provided they implemented the encryption reasonably.)

     As of right now, I'd harbor a guess that entire banks could be
robbed blind, that investments could be shammed or ruined, and
more.  It doesn't take a C.S. degree to spot these holes in software,
hackers keep finding holes because they keep being placed right
where hackers look for them.

     If members of the US Government continue to push for more
"secret" ways to "investigate", they will undoubtably become victims
themselves.  If the makers of the equipment the government uses cannot
protect themselves from intrusion, then the U.S. Government cannot avoid
intrusion.  I guess they will figure it out when we get nuked by
a few of our highest-tech jet-planes, or malfunction during combat.

     How long will it be before terrorist activities begin on the
Internet?  How long will it be before scientists will have to
conduct costly battles to keep thier information safe from
sabotage, alteration or piracy?  Even as we speak, programs have been
written which can disconnect socket connections between any two
machines.  CERT classified this as a "denial of services" security
violation.

     Worse yet -- very brilliant minds would be arrested for having
a "secure" computer system they built out of self defense.  People
who could have worked for the government will be denied security
clearance, and will have to move elsewhere to practice thier own
livelyhood.  Literally to be a citizen of the U.S. and to know
security would be a heinous violation of it, because anyone with but
a small idea could be a bank robber, terrorist, or otherwise right
when they discovered thier first backdoor..

     Dr. Robert Morris of the NSA wrote to me recently, explaining
to me that my development of the Mcrypt program was classified in
the same way as munitions, and high-tech ones at that.  They are
treated in the same way as surface-to-air missiles.  After hearing
that, I'd might as well write off getting a tour of NORAD with the
rest of the engineers this winter.  Its rediculous!  I guess I've
probably created a zoning problem, risking peoples lives having a
munitions / software encryption "research lab" in a residential
district.  One of my programs might accidently explode, killing
off most of the neighborhood.

     As usual, technology moves far too fast for the fogies on Capitol
Hill to deal with.  The green light needs to be given for the issue of
computer security to end.  Encryption will eliminate all backdoors
except backdoors that exist in the encryption itself.  If backdoors
become moot, they will stop being added into programs.  Bankers and
brokers can rest easier knowing that people are concerned about thier
computer safety, and the government, which might not be able to catch
the child molester with encrypted databases, won't lose the lives of
soldiers or pilots, and won't have to pay billions in damaged items
which terrorist hackers destroyed.

    (athiests need not read this)  Besides, no matter how tough your
encryption is, you can't hide what you do from either God or your mother.

     -- Eric Knight


>  These opinions are mine, and not that of either my employeer or
>  the Free Software Foundation, whose machines I'm currently (ab)using.