&
The Montreal Gazette
Wednesday, May 6, 1998

Cryptography battle heats up

by Matthew Friedman, mwf@total.net

Would you be willing to give the police and the Canadian Security Intelligence Service the keys to your home or business?

That's the question the information-freedom-advocacy organization Electronic Frontier Canada, known as EFC, wants Canadians to ask. Industry Canada's Task Force on Electronic Commerce made public its policy document - titled A Cryptography Policy Framework for Electronic Commerce - in February, inviting comments from Canada's business and high-tech sectors to help frame a national cryptography policy.

A rising tide of critics, from the EFC and private citizens to Canada's leading cryptographers - 14 of whom submitted critical letters to the task force last month - are demanding that Ottawa think carefully before pursuing any of the options proposed by the policy document.

Cryptography, or crypto, permits the encryption of data so that it can be accessed and read only by someone with the appropriate mathematical key or keys. The strongest form of this technology is public-key crypto, in which everyone has a private and public key.

If you want to send an encrypted message or file, you encode it with your own private key and your intended recipient's public key. The message can then only be opened using your recipient's private key.

Trust is crucial

"Cryptography, in its broadest sense, will be the foundation of electronic commerce", said Helen McDonald, director-general (policy development) for Industry Canada's electronic-commerce task force. "Who's at the end of the line when you're making an online transaction? You just don't have the same sense of trust that you get off-line, and we believe that electronic commerce needs a legal framework for cryptography to create that trust."

While there is widespread agreement among businesspeople, the government and cryptography experts on that point, there is little consensus on what form the legal framework should take.

According to McDonald, Industry Canada's policy document was intended to present the whole spectrum of options Ottawa will chose from in framing its crypto policy, which is due this year. However, some of those options smell a lot like Big Brother, and that has people like EFC president David Jones more than a little worried.

Jones is particularly concerned by the policy document's suggestion that Ottawa legislate some kind of key-recovery plan that would give law-enforcement and national-security agencies the right of access to keys to open any encrypted file or message.

Such a policy, promoted principally by law-enforcement agencies, could either make "strong" or unbreakable encryption software illegal in Canada, or establish a body to hold private keys in escrow in case the police need to crack an encrypted message.

"One of our concerns is that crypto could conceal activities of organizations that pose a threat to national security", said CSIS spokesman Marcia Wetherup. "The ability to decrypt messages and data has a significant impact on our ability to monitor security threats to Canadians."

No example given

Jones isn't impressed. "The police have never given a single example of a real investigation in Canada ever being blocked by the inability to get access to encrypted data", he said.

"They imagine that, in some hypothetical future situation, their investigative ability might be assisted if they can decrypt data or communications. And for this extremely limited, and possibly insignificant benefit, they seem willing to sacrifice the privacy and security of 30 million Canadians."

Indeed, any key-recovery plan would have more of an impact on law-abiding citizens and businesses than on criminals and terrorists.

It's hard to imagine that the cocaine cartels would object to using illegal, possibly foreign, crypto software that doesn't comply with Canadian key-recovery legislation.

Most ordinary Canadians, on the other hand, would have no choice but to buy whatever - substantially weaker - crypto products they could get at their local software store. Consequently, CSIS and the police would be able to read your E-mail, but they still wouldn't be able to crack the messages that they say they have to be able to crack.

To make matters worse, a mandatory key-recovery policy could actually aid criminals, Jones said. "The problem is that it creates an unreasonable risk that criminals will gain access to these big caches of keys and then be able to intercept business correspondence, forge digital signatures and conduct fraudulent E-commerce transactions."

There is even a question of whether key-recovery is even feasible. For one thing, it's impossible to tell the difference between an encrypted document and random text, and unless legislation made it illegal to transmit or store illegible text, such a plan would simply be unworkable. Moreover, there would be no barrier preventing individuals from simply downloading the latest strong crypto tools from the Net.

Even Ottawa-Carleton Police chief Brian Ford, chairman of the Law Amendments Committee for the Canadian Association of Chiefs of Police, doesn't think key-recovery for stored data and Internet messages is workable.

Yet, the CACP, along with CSIS and the Communications Security Establishment,Canada's ultra-secret signals-intelligence service, has been pressing for a key-recovery plan. "We're still going to ask for what we've been asking for", Ford said. "But I don't see it happening."

If that's the case, then why press for mandatory key-recovery? "I think they have always recognized that communication technology is a moving target", said Jones. "If they can delay the widespread deployment of strong crypto, at least it buys them some time to devise new strategies for how they'll deal with a society and a world in which they have far less surveillance capability than they currently enjoy."

While that may be understandable, it's hardly reason enough to deprive Canadians of strong crypto technology and expose us all to one of the most serious threats to personal privacy that has yet emerged in the information age.

EFC is promoting privacy and information security through its Golden Key campaign. To participate, the organization simply asks that you display its Golden Key logo on your Web page, or send a message of support to: goldenkey@efc.ca


Copyright © 1998 by The Montreal Gazette. All Rights Reserved. Reprinted with permission.