Strong Cryptography and You

Posted 11/28/95

Why should I care if I can't use Cryptography?

After all, Law-Abiding-Citizens have nothing to hide, right?

Right?!?

Uncle John's Answer:

If you feel that way, drop me some e-mail. Please include your credit card number, expiration date, and billing address. Multiple cards are accepted. Just kidding. No one would do that, would they? Well, they do it every day. They do it on AOL, when they use convenient on-line ordering. They send e-mail to vendors in the clear, thinking no one but the intended recipient will ever be able to read it. And they put their credit card numbers at risk. The internet in most of it's forms is not secure. I know, I'm rehashing a well known fact. But it still needs to be said. Let me tell you a little story...

If you read the last droppings on this page, (still available here), you know I was having a shopping crisis. Well, Uncle John is an establisheell, Uncle John is an established "net pilot", so he decided to see what the web held in terms of easy browsing for and ordering some lovely gifts for his favorite beings. And find he did! Just hit Yahoo, Lycos, or Webcrawler with the query "shopping" and you'll see what I mean. You can buy just about anything on the net, including books, steaks, clothing, airplanes, bread machines, CD's, etc.

You can order in many different ways, too. The simplest is the telephone. The vendor provides his catalog on-line, and an "800" number to call to place an order. This is pretty secure, since there is a very strong set of laws to discourage wire tapping. This is also the way most people shop mail order, catalog open, credit card nearby, phone in hand. It has been accepted for years as a great way to do business. Of course that would change if the phone system went back to party lines; nobody wants all their neighbors to hear their credit card number. Keep that thought in mind, it will come up later.

Next is the most preferred, the use of secure servers and browsers. (can I mention Netscape here without paying royalties? Maybe they could throw me a few scheckels for the plug?) Netscape Commerce Server is a product that runs on the host machine at the vendor's site and serves documents to web browser-equipped clients (like you). It does the same thing that the other web server products do, with one very do, with one very important exception. It can use the RSA (Rivest, Shamir, and Aldeman were the inventors, hence the name) public key encryption algorithm to provide a secure channel through the internet for the passage of sensitive information. I encourage the reader to consult the above link for more information about this powerful technology. Netscape has information available as well. The combination of the Netscape browser (according to some estimates, 70% of all the web browsing done is with this software) and the Netscape Commerce Server provides a very secure transaction channel over the ever-so-open internet. If someone intercepted a message between these two packages, running in secure mode, They would need years of time on multiple supercomputers to "crack" the encryption and read the data. Secure mode is indicated on the browser by a solid blue bar at the top of the browser window and an unbroken "key" icon in the lower left corner. Only when these are present should you even think about passing sensitive data to the server (using an order form, for example). I have recently successfully done this, I ordered and received some music CD's and cassettes from CDNow, and it could not have been easier. They deliver very quickly, and have a huge selection of common and obscure music, two thumbs up. two thumbs up. (Here I go with the free plugs again).

The next best thing is of course, e-mail. (but Uncle John, isn't e-mail bad? Shut up and keep listening, Billy). I would not send an unencrypted e-mail to anyone anywhere anytime if it contained information I did not want the Reuters news service to pick up. Not that Reuters reads other peoples e-mail, (Reuters, please don't sue me!) I simply mean that regular e-mail is almost equivalent to world-wide broadcasting. The architecture of the internet is deliberately fault-tolerant. Which is to say that there are any number of paths which connect a given point "A" with any other point "B". And along each of these paths are many computers which serve to relay information along the net. Get hold of a ping utility that has route tracing capability and ping any server. You will see from one to dozens of IP addresses listed, depending on the "net" distance between the two machines. If you send mail to someone on that server, that message will be available to a sufficiently adept person on each and every one of those machines. (remember the party line thing?) Not that all system administrators or computer users are likely to read your mail, but it only takes one with bad intent to give you a phone book sized credit card bill next month. But I just ordered stuff with e-mail. And although I cannot guarantee that the vendor is legitimatedor is legitimate, since I have not received the items yet, I do know that he is the only person who got my credit card number. (Note: I have since received the original order and my order for "Darwin fish" plaques for my car from Uncomyn Gifts. If you are into Babylon 5, or believe in Evolution, check Bruce's place out!) I sent him a message only he could read. I know this because I encrypted it with PGP (Pretty Good Privacy) using his public key. PGP is a program written by Phillip Zimmermann which uses the RSA algorithm and has a lot of functions for dealing with keys, and "signing" and encrypting files. It is available free for private use to anyone in the US and Canada...for now. Because it uses the extremely powerful cryptography in RSA, (along with the IDEA bulk, or symmetric encryption algorithm) I am sure that the message I sent could only be decoded by the person whose public key I used to encrypt it. And since I used my private key to sign the message first, the receiver can use my public key (published on the internet key servers and available here) to verify that I sent it. Most people would agree that I had every right to take these measures, since the message contained my credit card number, and I have a right to keep that between myself and the vendor. Don't you tear up you tear up your own carbons?

It is a good thing that both I and the person I dealt with are in the USA, though. And it is a shame that someone in London can't buy music from CDnow with the same sense of security I had. Because nearly unbreakable cryptography like PGP cannot be exported. The United States Government is prosecuting Mr. Zimmermann because he released the code on the internet. Cryptography that is sufficiently strong (meaning that it uses a key of longer than 40 bits in length) is classified as a munition by the federal government, and falls into the same category as jet fighters and atomic bombs. So if you do obtain PGP, RSA, or the Non-export version of Netscape, do not send it to your cousin in Brussels, unless you have a lot of time and money you don't mind giving to Uncle Sam. If you do have money you don't need, please send it to the Phil Zimmermann Defense fund, where it will do us all some good.

The Government does not want you to be able to do what I did when I sent that mail message. They have decided that free Americans don't have the right to send encrypted messages to each other. Forget commerce for now. The public would be outraged if the government outlawed all mailing envelopes and dictated the use of postcards for all mail. But the Government is doing everything in it's power to do just that for electronic correspondctronic correspondence. You would not want to write love letters on postcards, right? The argument (as usual) is that dangerous pedophiles and drug lords are using strong cryptography to hide their elicit dealings from police. So for the children's sake, we must ban this insidious menace. Think about that when you write that postcard to your lover telling her how much you liked having her _______ your _______ last week in Phoenix. Or join the fight to keep your right to privacy.

But I digress. On my shopping spree, I came across several sites who recommended sending in an order using unsecure e-mail, or who provide a non-secure form to fill out. Although these vendors might have valuable goods or services, they are fostering an environment which could have dire consequences for commerce on the internet. If someone gets taken because they innocently handed their card number to an unscrupulous vendor, the vendor gets a bad (and deserved) reputation. But if they pass the information over the net in the clear (unencrypted) to a legitimate vendor, and someone gets it and uses it illegally, the net and the vendor get the blame. And the press will eat it for breakfast, lunch and dinner. And the senators will fall all over each other to get internet commerce banned or severely regulated. And no amouted. And no amount of logic or reason can stop that kind of tide before it does real damage. I urge anyone who is going to conduct business over the internet to use some form of security in the form of cryptography to protect them and the people they do business with.

In the next few months or years, the future of electronic commerce will be decided, along with the future of the constitutional right to privacy, and the ability to conduct secure transactions with folks in other countries. As the world is brought even closer together by the net, it will be increasingly important to have the same rights in cyberspace that we enjoy in the "real" world. Keep in mind, there is no difference in the content of the communications in the two worlds, only in the medium used to transmit them. That is why there should be no difference in the freedoms and protections of privacy available either "place." It is up to us to ensure that the internet or it's successors can be used to the full potential that is promised. Speak out and vote to keep our rights in cyberspace. This time, let us do it for the children!