As government surveillance increases, many people are turning to encryption to protect their privacy. After the 9/11 attacks, many governments have expanded their surveillance powers, including the United States, Canada and the United Kingdom. Snoopers may not understand encrypted communications.
Encryption codes a message so that it cannot be understood by anyone other than the intended recipient. This can be done by talking in code over the telephone or by mathematically encrypting data over the Internet. Strong encryption usually refers to virtually unbreakable military-strength data encryption. It is used outside of the military primarily for private messaging, securing purchases online, online identity verification, and transmitting sensitive doctor-patient information.
PGP (Pretty Good Privacy) is the standard for Internet encryption. PGP works by creating both a public key and a private key. The public key is available to anyone, while the private key is kept a secret. The public key is used to encrypt a message and the private key is then used to decode it. PGP’s security comes from the difficulty in factoring very large numbers. Until a more efficient way to factor numbers is found, cracking a PGP encrypted message is virtually impossible. It is frequently pointed out that ‘pretty good’ is an understatement about the privacy offered by PGP. The only way an outside party could decrypt a message would be to somehow acquire the private key from the user or try every possible key (which would take about 100 million years with modern technology according to MIT mathematician Roger Schroeppel). For more information on PGP security read the PGP Attacks FAQ.
New Legislative Powers
In the United Kingdom the Regulation of Investigatory Powers Act (RIP) of 2000 makes it a crime to withhold encryption keys from the government (punishable by up to seven years jail). The United States has a history of trying to limit civilian use of military-strength encryption. Legislation was proposed to require government back doors be built into encryption software during the Clinton administration. These proposals failed due to commercial opposition and protests that encryption bans simply would not work. Public outrage over post-9/11 legislation, ostensibly for “homeland defense”, has created greater awareness of encryption techniques. Government and law enforcement agencies, consequently, have a renewed interest in limiting access of encryption to the general public.
Encryption’s opponents contend that sacrificing some privacy is necessary to insure national security. “[Encryption makers] have as much at risk as we have at risk as a nation, and they should understand that as a matter of citizenship, they have an obligation [to provide the government back door access to encryption products],” Sen. Judd Gregg (R-New Hampshire) said in a floor speech after the 9/11 attacks. Gregg was pursuing legislation that would require government backdoors to be built into all encryption software, but suddenly changed his mind according to Wired News.
The Clipper Chip
Strong encryption’s security is compromised by the backdoor system proposed during the mid-1990s. The system, known as the Clipper Chip would transmit keys to law enforcement agencies so that they could acquire keys to unlock encrypted messages. Unfortunately, when the government’s copy of a key is transmitted to “key banks” it risks being intercepted. Additionally, key banks themselves could become targets of terrorist hackers. See the Clipper section of the RSA’s Cryptography FAQ for more information. The material that terrorists could possibly intercept through government backdoors includes credit card numbers that could be used to fund terrorist acts and personal information that could be used for identity theft. “Having a good, strong crypto infrastructure in our country is part of what we need to combat terrorism,” PGP creator Philip Zimmermann told Reuters news agency.
In addition to the security issues presented by government backdoors is the question as to whether backdoors would do any good for law enforcement agencies. “. . . It [a law banning strong crypto] doesn’t prevent terrorists from getting their crypto from somewhere else,” James Lewis (director for the Technology and Public Policy Program at the Center for Strategic and International Studies, Washington DC) pointed out in a Zdnet News interview.
DoJ v Zimmerman and PGP
The controversy began in 1991 when Philip Zimmerman created PGP. The software was capable of encrypting files and e-mails through the use of state of the art patented encryption algorithms. Zimmerman’s friend Kelly Goen distributed the software by uploading it from his laptop to various Internet newsgroups and dial-up bulletin board systems from pay phones with an acoustic coupler. Steve Levy’s book Crypto (New York: Penguin Putnam, 2001) reveals that Goen was very caught up in the drama of distributing the software. Levy quotes computer activist Jim Warren saying Goen “. . . wanted to get as many copies scattered as widely as possible around the nation before the government could get an injunction to stop him.”
Even though Goen was careful to only upload the software to US-based software, Zimmerman spent the next five years involved in a legal battle with the US Department of Justice for violating export regulations on encryption software. In spite of this (or because of it) PGP became the standard for encrypting electronic data. In 1996 the Justice Department dropped the case and PGP was sold to Network Associates who is trying to sell the rights to another company.
PGP is available for all major operating systems and is easy to use. It has also spawned a non-patented clone called GPG (Gnu Privacy Guard). Zimmerman now working for HushMail, a free Web-based e-mail service with built-in PGP encryption.
Encryption: A Guide to Possibilities
If backdoors in software or RIP-esque key on demand laws become an international standard, there are ways to get around them. One-time pads and deniable encryption such as steganography would still be able ensure privacy.
Rubberhose: Rubberhose is a UNIX-clone software package from the United Kingdom. Rubberhose allows users to hide data on their hard drives. According to the Rubberhose site: “If someone grabs your Rubberhose-encrypted hard drive, he or she will know there is encrypted material on it, but not how much — thus allowing you to hide the existence of some of your data.” This is advantageous in the RIP-model. If a corrupt government seizes a hard drive, it would be possible for the user to only give away the keys to certain non-offensive data (such as a file named “Mom’s Secret Cookie Recipe”). Of course, this would be of little use in the backdoor model because use of encryption without backdoors would be illegal.
Steganography: Steganography is the practice of secretly embedding data into other data so that it doesn’t appear that communication has occurred. This could be done non-technically, for example, by using code words in the classified ads section of a newspaper. Software such as OutGuess hides messages in seemingly random portions of other files such as images or sounds. According to the OutGuess site: “OutGuess preserves statistics based on frequency counts. As a result, no known statistical test is able to detect the presence of steganographic content.” The drawback is that the recipient must have a key to unlock the hidden information, and that key must somehow be transmitted. One of the major advantages is that a message can be posted in public if the recipient knows what to look for, thus making it difficult for others to detect that communication has even occurred. Your recipient could agree, for example, to communicate through popular files on the Gnutella network. Imagine a group of hackers communicating through Britney Spears publicity photos.
One-time Pads: One-time pads are a form of un-breakable encryption through the use of random numbers. In a plain text message, a different random number represents each character each time it is used. Only someone with the key can decipher it because all possible values for the random numbers are equal. The only way to break this code would be to acquire a copy of the key. The problem is that two parties communicating through this method must have a secure way to transmit keys. The other problem is that the key can be longer than the message itself. The advantage to this method is that it does not require a computer, only a way to generate random numbers.
Whether it’s an embarrassing note about your sex life or your secret recipe for banana pudding, everyone has something they would rather other people not see. The recent increases in government-permitted surveillance make encryption useful to everyone, not just paranoid nuts.
More:
PGP International The home of Pretty Good Privacy, the de-facto standard for Internet-enabled digital encryption. Features news, manuals and downloads.
Electronic Frontier Foundation “The Electronic Frontier Foundation (EFF) was created to defend our rights to think, speak, and share our ideas, thoughts, and needs using new technologies, such as the Internet and the World Wide Web. EFF is the first to identify threats to our basic rights online and to advocate on behalf of free expression in the digital age.”
Philip Zimmerman Philip Zimmerman created PGP. This site includes his PGP writings, Senate testimony, news, consultancy services and an extensive links collection.
RSA Cryptography FAQ RSA Laboratories have created an extensive FAQ on cryptography’s history, the major cryptosystems, techniques and applications, and real-world cases. Highly recommended.
One-time Pad FAQ A quick guide to one-time pads, explaining how this cryptosystem works, distribution methods and sources of randomness.
GnuPG An open source encryption standard. The site includes an extensive FAQ, the GNU Privacy Handbook and more. “GnuPG stands for GNU Privacy Guard and is GNU’s tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC 2440.”
HushMail Free encrypted Web-based e-mail. “HushMail eliminates the risk of leaving unencrypted files on Web servers. HushMail messages, and their attachments, are encrypted using OpenPGP standard algorithms.”
Freenet Project Freenet is a peer-to-peer (P2P) publishing network that enables you to publish encrypted documents. Ian Clarke’s system has been used by grassroots political groups and individuals to publish controversial information.
Rubberhose “Rubberhose transparently and deniably encrypts disk data, minimising the effectiveness of warrants, coersive interrogations and other compulsive mechanims, such as U.K RIP legislation. Rubberhose differs from conventional disk encryption systems in that it has an advanced modular architecture, self-test suite, is more secure, portable, utilises information hiding (steganography/deniable cryptography), works with any file system and has source freely available.” [Update: Interesting historical sidenote, this now discontinued project was created by Julian Assange, see also: Wikipedia entry for Ruberhose]
OutGuess “OutGuess is a universal steganographic tool that allows the insertion of hidden information into the redundant bits of data sources. The nature of the data source is irrelevant to the core of OutGuess. The program relies on data specific handlers that will extract redundant bits and write them back after modification. In this version the PNM and JPEG image formats are supported.”
(This article originally appeared at http://www.disinfo.com/archive/pages/dossier/id2007/pg1/ January 31, 2002)