If PATRIOT compels commercial enterprises to subvert cryptography, how is it possible that huge companies have built sturdy end-to-end encryption systems without key escrow? Are some of the largest companies in technology simply flouting the law?

> Are some of the largest companies in technology simply flouting the law?

I for one would be shocked.

I walked into that one.

;-)

I wasn't personally suggesting that PATRIOT specifically compelled commercial enterprises to subvert cryptography, and we know from what's been leaked about BULLRUN that at least some of the times that those activities occur, it's probably been upstream during (for example) standards development.

It may, however, still be the case that PATRIOT creates a legal authority from which multiples agencies might ask companies to undermine some of the goals of cryptography--depending on your politics and your vantage point--to be able to profile lawful intercept capabilities, e.g. by offering unmonitored access through something like Google's eDiscovery portal or just by complying with legal requests.

I'm not commenting to defend NSA or, for that matter, cryptographic standards efforts. So: much of this comment is unresponsive to mine.

What I'm interested in is, what's an example of some authority of PATRIOT compelling a commercial enterprise to weaken or subvert their cryptography or, as you put it, the goals of their cryptography? Be specific, please. This thread lead off with a truly wacky and false claim about compulsory key escrow. I'd prefer not to see it rehabilitated by a flight to abstraction and appeals to our shared dislike of NSA.

I tend to think you're right and that we live in a world where key disclosure and various other methods of obtaining information from companies would be much more common than key escrow, especially key escrow implemented in response to a specific government request. I believe affected companies/people are typically gagged from discussing or even acknowledging the existence of--for example--an NSL demanding user data in the context of PATRIOT.

My understanding was that the government--typically the FBI--could send NSLs to tech companies to secretly demand a broad range of user information, and short of being Tahoe-LAFS and it being impossible to fulfill such a request or being Lavabit and asking for money to build in a backdoor to fulfill such a request, companies had to find a way to comply.

In other words, my understanding was more that PATRIOT created a legal authority that allowed the government to secretly demand user information in ways that made requests difficult to challenge in court or disclose to affected users, and that the technical and other specifics of how to satisfy those requests was typically up to the companies.

I'm not aware of compelled key escrow (but also wouldn't necessarily expect to be given the role of gag orders), but Lavabit might be considered an example of compelled key disclosure. At least technically, that's a very different beast.

>huge companies have built sturdy end-to-end encryption systems without key escrow?

I would say that they haven't.

_RSA_, whose only product is sturdy crypto, subverted their products.

I would say that this sentence amounts to an unverified assumption. I can't actually think of an example - can you?

That RSA's only product is sturdy crypto would be news to RSA, which began as a two-factor token company (called SDTI), later purchased the RSA brand, and now sells a gigantic suite of enterprise security and compliance products, along with their flagship multi-factor products. I would be surprised to discover (but have not looked into it) that BSAFE --- the RSA product you're referring to --- was even a rounding error for RSA's revenue.

If the closest you can come to arguing that all commercial tech enterprises are "voluntold" to build key escrow is a crypto library used by virtually no end-user encrypted communications systems, I'm suddenly a lot less interested in this discussion.

I think Dual-EC probably was a backdoor. I think any commercial product that adopted Dual-EC is worthy of suspicion. Fortunately, so far as I can tell, virtually nothing that matters ever used Dual-EC.

Re: RSA having security and compliance products. This comment does nothing to dispel the thesis. RSAs primary business is secure software solutions, a major component of which is sound cryptography.

If the financial kickback to RSA was 'small' (care to post an analysis) then they added the backdoor to BSAFE for other reasons. Therefore I don't think that argument addresses the thesis.

Here are a list of suites NIST validated with DUAL_EC.

http://csrc.nist.gov/groups/STM/cavp/documents/drbg/drbgval....

Plenty of products relied on BSAFE including enterprise security products like McAfee.

https://lwn.net/Articles/566329/

But practical impact aside, you haven't addressed the primary thesis.

Sound cryptography is a tiny, tiny portion of software security. Most software security --- in fact, most information security in general --- doesn't touch on cryptography at all. Certainly most enterprise security and compliance products don't.

Indeed, many random enterprise security products did use BSAFE. Most of them did so because during the mid/late '90s, a BSAFE license was how you shipped certificate-based public key features, because RSA was enforcing their patent. Many of those products include BSAFE on their manifest but use OpenSSL and Microsoft SChannel instead. And the features we're talking about are things like login pages or agent/server communications for things running on 10-net addresses.

How many of those enterprise security products did end users rely on to protect their secrets from the USG? I'm going to go out on a limb and suggest that number is zero.

We are in mostly full agreement on this comment. (I do not think it challenges the thesis.)