BJK homepage: key recovery

Bert-Jaap Koops homepage - research

key recovery

Key recovery, key escrow, government access to keys - whatever it's called, it means a crypto system that allows the government to access the key or plaintext. It's meant to catch criminals, or to give law-abiding citizens a robust, police-friendly crypto system, or both. Various systems are being researched, yet all involve security risks.

Big Brother inside

terminology
survey of key recovery systems
key recovery projects
risks of key recovery
essential reading
recommended reading and links

Terminology

Clipper chip	chip for EES, proposed by US government in 1993, providing government access through a LEAF; died somewhere in 1996
data recovery	all-encompassing term for retrieving the plaintext of encrypted data if the key for decryption is not available (this includes key escrow, key recovery, and plaintext recovery; to be used for government or for users' needs); modern equivalent of GAK
EES	Escrowed Encryption Standard; US standard for key escrow system, using the Escrowed Encryption Algorithm, based on the classified symmetric crypto system Skipjack
GAK	Government Access to Keys; outdated term for crypto systems that allow a government (law-enforcement or national-security agencies) to access crypto keys or plaintext; although outdated, still useful as a generic term
key backup	euphemistic synonym for key escrow
key deposit	synonym for key escrow
key encapsulation	new term for key recovery in its original sense: a crypto system which provides data recovery by having people tag along to messages a recoverable session key rather than deposit their private keys
key escrow	generic term for crypto systems that provide government (or occasionally user) access to keys by having people deposit their keys with a TTP
key management	the process of key generation, key certification, certificate distribution, and certificate revocation, may also include key deposit or backup; used in the OECD Guidelines as a potential euphemism for key recovery (which suggests that, once 'key recovery' becomes tainted with negative implications, key management may replace 'key recovery' as the next generic term for GAK)
key recovery	originally a term for a crypto system which provides GAK by having people tag along to messages a recoverable session key rather than deposit their private keys; is increasingly used, however, irrespective of the technology, as a generic term for GAK and a replacement for 'key escrow' which has become a too negative term
LEAF	Law-Enforcement Access Field; data unit sent by Clipper chips which enables the Clipper TTPs to decrypt the message; sometimes also used in other key recovery systems
LEAK	Law-Enforcement Access to Keys; law-enforcement part of GAK; I introduced this term in my Ph.D. thesis as a generic term for crypto systems that provide the police with access to keys or plaintext without the user's cooperation or knowledge (Law-Enforcement Access to Data would be more correct, but LEAK seems the more appropriate acronym)
plaintext recovery	method that provides recovery of encrypted data if the key for decryption is not available by storing a back-up of the unencrypted data in a safe
private doorbell	confusing term circulating in the US around 1998 for key recovery (in its original sense)
TTP	Trusted Third Party; organization which offers cryptographic services, such as key certification, distribution, revocation, and time-stamping; may also denote a Key Escrow Agent or Key Recovery Agency

Back to Contents.

Survey of key recovery systems

Professor Dorothy Denning provides an extensive survey of key escrow and key recovery systems.

Dorothy Denning, Descriptions of Key Escrow Systems

Back to Contents.

Key recovery projects

In the US, over 60 companies are participating in the Key Recovery Alliance. Its working committees research technology requirements (interoperability), worldwide deployment requirements, and global business requirements. I haven't found a central homepage of the Alliance, though.

Trusted Information Systems (TIS) - RecoverKey

Similar to the US Key Recovery Alliance, but smaller in scale, seven European companies are studying the potential of key recovery ('confidentiality services') in KRISIS, as part of the European Union's broad project on information security.

Key Recovery in Secure Information Systems (KRISIS)

Back to Contents.

Risks of key recovery

In May 1997, a group of renowned cryptographers and cryptanalysts published a study warning against the risks of key recovery, based on the government requirements posed for timely law-enforcement access. The report "examines the fundamental properties of these requirements and attempts to outline the technical risks, costs, and implications of deploying systems that provide government access to encryption keys."

Their main conclusion is:

"Key recovery systems are inherently less secure, more costly, and more difficult to use than similar systems without a recovery feature. The massive deployment of key-recovery-based infrastructures to meet law enforcement's specifications will require significant sacrifices in security and convenience and substantially increased costs to all users of encryption. Furthermore, building the secure infrastructure of the breathtaking scale and complexity that would be required for such a scheme is beyond the experience and current competency of the field, and may well introduce ultimately unacceptable risks and costs. "

This is an important report, and it is essential that the increased security risks of key recovery are made clear.

However, I have four objections to the study.

The main problem is that it is based on four requirements that governments pose on key recovery systems. Two of these, however, are not essential to key recovery as such, viz. the requirement of 'access without notice' (a government could record ciphertexts and have them decrypted later, when the suspect is already aware of the investigation), and the requirement of quick, around-the-clock access (which, it is true, US and UK officials have called for, but which is not essential for all purposes). Taking these as 'essential' requirements means narrowing down the scope of the study to specific government proposals (notably, those of the US and UK).
The report is occasionally too sweeping. The researchers aim to make broad, general statements on key recovery, regardless of possible details. However, in some cases, this means they oversimplify, and overlook cryptographic protocols and features devised specifically to address part of the objections they raise.
The researchers point out that implementing mandatory key recovery is enourmously costly, but they do not consider alternatives for solving law-enforcement problems, which may also be costly. Although it is likely that key recovery is more expensive, you can't simply say a solution to a problem is (too) costly without taking into account the costs of the alternatives.
I think it is pity, although understandable, that the report is very US-centred. Key recovery is not being considered only in the US, and an implementation that is to work on any scale will have to be internationally acceptable. The report takes too little into account the requirements posed by non-US governments.

I would welcome a broader report that takes into account protocols addressing some of the objections to key recovery, that distinguishes between voluntary and mandatory key recovery, and that is based on key recovery as a concept, rather than on (US) government requirements that may not be essential.

Despite these objections, the main conclusions of the report are valid and on the mark. It's an important report, and I encourage everyone - especially governments - to read it.

Hal Abelson et al., The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption
1998 version of the same report

Back to Contents.

Essential reading

National Research Council, Cryptography's Role in Securing the Information Society, chapter 5.
Hal Abelson et al., The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption (1998 version)

Back to Contents.

Contents

Terminology

Survey of key recovery systems

Key recovery projects

Risks of key recovery

Essential reading

Recommended reading and links