A Technical Advisory Committee charged with developing a Federal standard for recovering cryptographic keys has told the US Secretary of Commerce of technical difficulties that will prevent it reporting on time. That’s a blow to government officials – not least FBI director Louis Freeh – who want to see key recovery made mandatory, so the government can recover encrypted information and make life difficult for organized crime. This Commmittee inherited those expectations from an earlier, failed attempt to mandate key escrow: the Clipper Chip (CI No 3,395). Reuters says it obtained the letter to Commerce Secretary William Daley. That’s a little disingenuous of the wire service, since the letter is freely available from the NIST web site along with the incomplete draft of the committee’s report. In spite of having published its work, though, the euphoniously named Technical Advisory Committee to Develop a Federal Information Processing Standard for the Federal Key Management Infrastructure, or TACDFIPSFKMI, says in its letter: We believe this document is not ready to be released for public comment. The draft certainly does make fascinating reading. The most recent set of changes, made by Steve Kent, chief scientist at GTE Internetworking, clearly alters the emphasis of the document. The word ‘standard’ is replaced throughout by ‘product’. A passage describing the consequences of not having key recovery has been softened. The document no longer states that it is necessary to ensure that data can be decrypted by authorized parties. Instead, the writers say they want to establish requirements for Key Recovery products. The document has is now not so much a detailed technical standard as a purchasing guide. Kent concurs with this interpretation: Most of these [Federal Information Processing Standards] are used for procurement purposes… Those changes were made by the committee specifically because we wanted not to make it a policy statement. So, will the private sector also be required to adopt key recovery? Technically a FIPS is just for Federal agencies, says Kent, in the past, industry has latched onto some of these even if they are in no way required to do so. If the key recovery FIPS is ever completed, vendors can expect to be very strongly encouraged to build their crypto software with a back door for officers of the law. However as the Committee explained in its letter, various problems make it unlikely that TACDFIPSFKMI, or as it prefers to call itself, Bob, will meet its July deadline. The technical difficulties were subtle details, Kent said, citing conflicts between the separate working groups drawn together only a few months ago. But observers are skeptical. It can’t be done, says Counterpane Systems’ Bruce Schneier, but they don’t know that. University of Auckland computer scientist and co-moderator of the sci.crypt.research newsgroup Peter Gutmann agrees: The trouble is that what they’re trying to do is beyond the state of the art, he says. What’s more, Schneier believes the Committee with the 12-letter acronym has been given its impossible job for exactly the wrong reasons. The US government has been telling everyone that key recovery is what industry wants. Whenever industry gets together they say they don’t want it. Then the FBI steps in and says that’s not acceptable. Why is Louis Freeh so anxious to be given the power to recover crypto keys? We’re not actually sure, Schneier admits, it’s extremely expensive, it’s difficult, and from all that we can establish, encryption is not actually a problem in Federal investigations. You could hire a few hundred FBI agents for what key recovery would cost. It’s hard to believe that some amorphous technology that criminals can get around anyway would be better than a few hundred more FBI agents. Most critics of key recovery say it is another example of unjustified government surveillance of private life on the pretext of preventing crime. Sure, cryptography is open to misuse, says Schneier, just like kitchen knives, ladders and the interstate highway systems. Yes, criminals can use ladders to commit a crime. But I still like having ladders. Schneier believes the government will never have its way with key escrow. Gutmann is not so optimistic. There will be creeping law changes. First building key recovery in will be voluntary. Then it will be mandatory, he says. What makes it hard at the moment is that there is no infrastructure. In five years, when the infrastructure is there, it will be just a matter of changing the law. Though the committee’s charter does expire next month, the 22 members have declared themselves ready to carry on if their country demands. So no Son of Clipper Chip today, but the show is far from over. As Gutmann says: The government just keeps sugar- coating the poison pill by giving it a different name.
