Cryptographic Techniques as Munitions: US Export Controls and EU Approaches

revised

Transcript

1. Cryptographic Techniques as Munitions: US Export Controls and EU Approaches: A Historical Context Jarod Jett
2. The NSA vs Everybody
3. Topics: 1. Cryptography Background 2. The legalities 3. The NSA 4. The Rise of Public Cryptography 5. Export Challenges
4. Cryptography The "art of writing or solving codes" Ensuring the con dentiality of your data.
5. The Problem Alice wants to talk to Bob Bob and Alice want to know who they're talking to Eve wants to listen in
6. Ancient Cryptography Julius Caesar and the "Caesar Cipher"
7. Early-Modern Cryptography The Enigma Machine
8. Topics: 1. Cryptography Background 2. The Legalities 3. The NSA 4. The Rise of Public Cryptography 5. Export Challenges
9. ITAR International Traf c in Arms Regulations Seeks to control "Dual-Use" goods, goods that have both a civilian and military purpose.
10. COCOM The Coordinating Committee for Multilateral Export Controls An "international organization" of 17 members, including the United States, Japan and most of the EU. Maintained lists of items prohibited from export Not a legal body Dissolved in 1994
11. The Exception Export controls do not apply to fundamental research from an accredited university that is ordinarily published and shared broadly with the academic community Argued for on rst amendment grounds We'll be revisiting this.
12. Topics: 1. Cryptography Background 2. The Legalities 3. The NSA 4. The Rise of Public Cryptography 5. Export Challenges
13. Military Dominance Cryptography is HARD Very resource intensive: Money People Time
14. World War II Army Intelligence Navy Intelligence United Kingdom Partnership Japanese Diplomatic Codes Japanese Naval Codes German Codes
15. Problems Decentralized intelligence apparatus leads to: Redundant effort Breakdown of communications Greater possibility of lapse of secrecy
16. The NSA Founded in 1952 Intended to keep all cryptography and signal intelligence work in one organization Insanely secret
17. Monopolizing Crypto The NSA doesn't like competition. Tactics: Patent control Hiring
18. Patent Control The NSA retains the right to monitor any patent requests concerning cryptography and classify any that it deems too powerful to be put into the public domain. Invention Secrecy Act of 1951 6,193 patent secrecy requests before 1991
19. Hiring The NSA uses selective hiring to "disappear" people's work Everything you were working on is now classi ed "I worked for the Department of Defense"
20. DES 1973 - National Bureau of Standards called for a single encryption method that everyone would use, in both the public and private sectors IBM was already working on an algorithm called "Lucifer" that they decided to submit This is where the NSA stepped in
21. The NSA and DES We want to control the implementation of this system. You will develop it in secret, and we will monitor your progress and suggest changes. We don't want it shipped in software code just chips. Furthermore, we don't want it shipped to certain countries at all, and we will allow you to ship it to countries on the approved list only if you obtain a license to do so. “ “
22. The NSA and DES Secrecy order (that itself was secret) Every document related to the project was classi ed Cut the key length from 128 to 56
23. Topics: 1. Cryptography Background 2. The Legalities 3. The NSA 4. The Rise of Public Cryptography 5. Export Challenges
24. Dif e-Hellman Whit eld Dif e and Martin Hellman 1976: "New Directions in Cryptography", IEEE Transactions on Information Theory We stand today on the brink of a revolution in cryptography. “ “
25. Public Key Cryptography Bob has a public key, used to encrypt messages, and a private key, used to decrypt them. Two purposes: Secrecy Identity Veri cation
26. RSA Ron Rivest, Adi Shamir, Leonard Adleman MIT, 1977 First Implementation of Public-Key Cryptography Revolves around the idea that factoring large numbers is really really hard
27. NSA Response Behind the scenes funding deals Presidential directive giving "control" over research grants Allegations the IEEE violated ITAR Secrecy Orders
28. Failures The NSA couldn't stop funding The ITAR restrictions the NSA cited were found unconstitutional Public outcry forced the NSA to back off on secrecy orders Solution? Cooperation.
29. Topics: 1. Cryptography Background 2. The Legalities 3. The NSA 4. The Rise of Public Cryptography 5. Export Challenges
30. Export Licenses Cryptography as "Dual Use" Export Licenses State Department or NSA?
31. Lotus Notes Ray Ozzie, 1987 Intended to include RSA as an "essential component" Shipped overseas with RSA and RC-2 encryption, with a key size of 32 bits United States version had a 64 bit key
32. Sources Crypto: How the Code Rebels Beat the Government- Saving Privacy in the Digital Age. Steven Levy, 2001 The Puzzle Palace: A Report on America's Most Secret Agency. James Bamford, 1982 Crypto Law Survey, www.cryptolaw.org Bert-Jaap Koops EFF "Privacy - Crypto - ITAR Export - FOIA-Obtained Documents" Archive https://w2.eff.org/Privacy/Crypto_export/ITAR_FOI A/ Electronic Frontier Foundation