Beyond Cyberlaw cove - a place where lawyers examine the implications of technological invention - is a vast sea of scientists who do the actual inventing. Frequently, their creations have some practical application that enhances productivity or provides a new way of performing a task. Every so often, however, one of these creations has a profound impact on society and spawns a new field of innovation.
Recently, public tribute was paid to one such invention: Public-Key Cryptography (PKC). The event, held at the Computer History Museum, to honor the inventions, inventors, historical milestones and the future of Public-Key Cryptography was sponsored by Voltage Security and RSA.
Why is PKC significant? Public Key Cryptography is the technology used to keep digital communications secret and secure. In this Age of Information, where people conduct a good portion of their lives remotely via online applications, PKC is ubiquitous technology. It can be found in online banking, e-commerce, and e-mail applications. Personal privacy, data security, identity theft, e-discovery, confidentiality, terrorism, e-filing - are all somehow related to PKC.
The Creation of PKC
The evening's program began with a history of PKC, delivered by John Markoff of The New York Times, chronicling the civilian invention of asymmetric key exchange by Whitfield Diffie and Martin Hellman in 1976. Both men were present and shared behind-the-scenes stories surrounding the creation of the Diffie-Hellman key exchange system, the first major published PKC invention, which established a shared secret key over an unprotected communications channel without using a prior shared secret.
PKC took another step forward in 1977, when a group of M.I.T. students expanded on existing research and published the algorithm that came to be known as RSA (named after the creators), which incorporated both public key encryption and digital signature.
After these early inventions, the story of PKC was colored by a long struggle between government control and industry pressure for commercial use of the technology. In spite of this tension, crypto technologies have experienced continued growth and innovation over the past thirty years.
Today PKC is something of an umbrella term for the different ways to maintain the secrecy and integrity of data. Although it began with key exchange, PKC has grown to encompass authentication, digital signatures, encryption, and key management technologies.
Government vs. Industry: a Retrospective
Following the PKC history lesson, Steven Levy, author of Crypto and Hacker, and Senior Editor at Newsweek moderated a PKC panel discussion. The panel also included:
- Mr. Ray Ozzie, Chief Software Architect, Microsoft Corporation
- Dr. Whitfield Diffie, Chief Security Officer, Sun Microsystems
- Dr. Martin Hellman, Professor Emeritus of Electrical Engineering, Stanford University
- Mr. Jim Bidzos, Former CEO, RSA and Founder, Verisign
- Mr. Brian Snow, Former Technical Director for the Information Assurance Directorate, National Security Agency, Retired
- Dr. Dan Boneh, Professor Computer Science, Stanford University
The government's interest in PKC was a major theme in the panel discussions. Initially, the federal government - the NSA in particular - had two initial reactions to the civilian invention of PKC, according to Brian Snow (who repeatedly disclaimed speaking on behalf of his former agency): 1) amazement that PKC was created in a non-government laboratory setting; and 2) recognition of the powerful functions of PKC as a weapon of war.
After the invention of PKC, "the world has not been the same," remarked Brain Snow.
Prior to PKC, nations at war would use ciphers to encode confidential communications. These classic forms of crypto used the same code to encrypt and decrypt a message, and cracking the code was not uncommon.
The government's great fear was that the new crypto technologies would be used against us by the enemy. Presumably, the U.S. would be at a great disadvantage if national intelligence could not decode information under strong encryption.
As a result, stringent federal control of PKC technology lasted for almost two decades. During those years, strict export controls were used to regulate permissible key length used in products that incorporated encryption algorithms.
Private industry, however, had an altogether different view of the federal control of PKC. Ray Ozzie recounted the lengthy negotiations with the government when he attempted to obtain an export license for his invention Notes, which incorporated a "hefty crypto key."
The question of whether the release of crypto keys would compromise national security was a real battle between the two camps. Jim Bidzos, representing the business application of crypto, commented, "Economic competitiveness is a part of national security."
Finally, in 1996, the government bowed to industry pressure over the need for secure online transactions. Federal controls on encryption standards were relaxed. Not long after this policy change, the Internet commerce experienced its first boom.
Although the government completely reversed its position in the late '90s, it continued to exercise some control over cryptography. For example, it attempted (with varying degrees of success) to implement national standard protocols for PKC, such as DES, Capstone, and Clipper chip technology. To date, the government has been most successful in its legislative attempts to mandate PKC. The use of crypto is now woven into the laws that govern industry sectors where confidentiality is crucial, such as the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the corporate Sarbanes-Oxley Act of 2002.
The Future of PKC
An audience question and answer portion concluded the program, and the future of PKC was briefly addressed. The panelists offered these predictions:
Dan Boneh: In 10 years, there will not be any data not encrypted. Software product security will be updated, and crypto will be deeply embedded into everyday processes.
Martin Hellman: If you have to do something extra to get security, most people will not do it. Transparent automatic crypto is what is now needed.
Brian Snow: The government is no longer in the way. It's now up to industry to implement good crypto in products.
Jim Bidzos: Resisting Quantum Computing is the new challenge for crypto.
Whitfiled Diffie: You should read my brilliant paper about Cryptography in 3001, written in 2001. It says there won't be any [crypto].