EFC - Golden Key - Strong Crypto

Electronic Frontier Canada's
Golden Key Campaign

Canadian Crypto: True, Strong, Free

The goal of Electronic Frontier Canada's Golden Key Campaign is to promote privacy and security of electronic communication and information systems through the widespread public availability of strong encryption and the relaxation of export controls on cryptography.

Overview:

The Canadian federal government is revising its Cryptography Policy. This affects the privacy rights of every Canadian and you should be aware of what is at stake. Your continuing right to be able to use strong crypto to protect your personal information and communications is at risk.

Presently, Canadians enjoy considerable personal privacy and these rights are protected to a certain extent by legislation, including the Charter of Rights and Freedoms. Although some recent developments in communication, such as electronic mail messages and cellular telephone conversations, have made us all susceptible to eavesdropping by almost anyone with the right tools, there is a clear technological solution: Cryptography.

Cryptography is a term used to describe a collection of techniques, most often implemented as computer software, that allow people to store and communicate information in secret. In a vast country like Canada, these techniques are increasingly important because they allow people to communicate and share information over long distances, while still protecting their privacy. Cryptography is also an essential enabling technology for electronic commerce, since it allows confidentiality, security, authentication, and electronic transactions that are irreversible.

Cryptographic techniques can be used to scramble digital data so that it is unintelligible to anyone who might intercept your message. Since almost all communication is digitized these days, even your voice can be protected by these techniques.

Although there are a variety of cryptographic techniques, all share one common feature. Decrypting scrambled information requires knowledge of a secret key. If the technique used to scramble the information in the first place is unsophisticated or weak, then it may be possible to determine the secret key simply by guessing. Since a computer program can keep on guessing and guessing tirelessly for days or weeks, many weak methods can be cracked this way.

On the other hand, mathematicians and computer scientists have developed some cryptographic techniques that are so sophisticated and strong that no amount of computer time or ingenuity can crack the code. If the secret key is kept secret, then the privacy and security of your message is protected.

If you're using cryptographic techniques to protect the privacy and security of your personal information, communications, and electronic transactions, then you want to be using strong crypto.

Some government departments don't necessarily like the idea of thirty million Canadians being able to keep secrets, whether it is chatting over the phone, sending email to a friend, or storing confidential records on our personal computer. These include:

Canadian Security Intelligence Service (CSIS)
Communications Security Establishment (CSE)
Royal Canadian Mounted Police (RCMP)
Canadian Assocation of Chiefs of Police (CACP)
Solicitor General's Office
Department of Justice
Department of Foreign Affairs & International Trade

There are even restrictions that limit the ability of Canadian companies who would like to export high-tech encryption products to our friends and allies around the world.

As part of the process for changing Canada's Cryptography Policy, the federal government has identified three specific areas for discussion:

Stored Information
files stored in your computer, or records stored in databases on corporate or government computers
Real-time Communications
conversations on the telephone, documents sent by fax, e-mail correspondence, audio and video transmissions over Internet
Export Controls on Encryption Products
encryption software or hardware made by Canadians to be sold to customers in other countries

The main policy decision is whether the government will require Canadians to disclose their secret keys, or require companies that make or use encryption software or hardware to collect and disclose the secret keys of their customers. This is called key recovery, and Electronic Frontier Canada is firmly opposed to it.

Here are a few policy options the government has identified in their recent discussion paper, "A Cryptography Policy Framework for Electronic Commerce -- Building Canada's Information Economy and Society"

1.
"[T]he government could prohibit the manufacture, import, and use of non-key-recovery [encryption] products in Canada."

2.
"Carriers [of real-time telecommunications] would be prohibited from transmitting messages unless in plaintext or encrypted by key-recovery hardware or software."

3.
"The export of strong cryptography would only be permitted if the products had approved key-recovery provisions."

We hope that you agree with us that in a free and democratic country like Canada, we should all be able to protect our privacy and security using the best available tools, including Strong Crypto. Please show your support for Electronic Frontier Canada by participating in EFC's Golden Key Campaign.

Upcoming Events:

October 7-9, 1998 (Ottawa)

The Government of Canada will host an international conference, "Realizing the Potential of Global Electronic Commerce" with participants from 29 countries that are members of the Organization of Economic Co-operation and Development (OECD). There will be up to 700 participants who will discuss various policy matters, including Cryptography Policy. Participation in the conference is "by invitiation only". (Conference Details)

Wednesday, June 24, 1998 (Vancouver)

The Fraser Institute is sponsoring a conference on Electronic Commerce. EFC's David Jones will be speaking on the topic of Privacy and Encryption. (Conference Details)

Monday, June 8, 1998 (Washington, D.C.)

The Electronic Privacy Information Center (EPIC) is sponsoring a conference on Cryptography and Privacy. Leading experts from government, industry, public interest groups, and academia will debate important legal, political, and technical issues. (Conference Details, Conference Summary, Speech on Canadian Crypto Policy)

Tuesday, April 21, 1998

Final day to make formal, written submissions to Industry Canada in response to their "Policy Framework" discussion paper.

Monday, April 20, 1998 (Ottawa)

Industry Canada hosted a government-sponsored roundtable discussion on Canada's Cryptography Policy. (Draft Agenda) (Invited Participants) (Meeting Summary)

Tuesday, March 31, 1998 (Ottawa)

Entrust Technologies hosted an industry-sponsored roundtable discussion on Canada's Cryptography Policy in an attempt to develop a consensus among industry analsysts and spokespeople.

Background Documents:

Industry Canada: Helen McDonald's Speech at EPIC Crypto Conference (08jun98): Summarizes what Industry Canada has learned so far from it public consultations on E-Commerce, and specifically Privacy and Cryptography.
EFC's Letter to Industry Canada (21apr98): This is EFC's response to Industry Canada's call for public comments on cryptography policy.
Leading cryptography experts wrote a Letter to Industry Canada (21apr98): Fifteen mathematicians and computer scientists, who are among the country's experts in cryptography, wrote letters to Industry Canada expressing their concern over the possibility of mandatory key recovery, and indicating that such a policy is not feasible, based on technical grounds.
GILC's Letter to Industry Canada (20apr98): This letter was prepared by EFC and signed by more than 20 civil liberty and human rights organizations around the world who are members of the Global Internet Liberty Campaign.
GILC/EPIC Cryptography and Liberty: An International Survey of Encrypt ion Policy (feb98): This survey of cryptography policies in almost 80 countries found that the virtually all countries have no restrictions on encryption products. The principal researcher for the survery was Wayne Madsen, who is a senior fellow with the Electronic Privacy Information Center (EPIC).
Entrust's Letter to Industry Canada (21apr98): This letter was formulated following the Industry Roundtable, held March 31, 1998.
RCMP's Letter to Industry Canada (21apr98): This letter was submitted to Industry Canada by RCMP Commissioner Philip Murray.
Chaffing and Winnowing: Confidentiality without Encryption: In this delightful paper, cryptographer Ron Rivest explains a simple method for sending secret messages without using encryption. Data is sent in the clear, but it is intermingled with with random bits that only the recipient knows how to filter out.
EFC's Statement on Canadian Cryptography Policy (14aug97): This is EFC's current position statement on crypto and it was submitted to Industry Canada last summer as part of government's informal consultation process.
Industry Canada's Cryptography Policy Framework (21feb98): The full title of this report is "A Cryptography Policy Framework for Electronic Commerce -- Building Canada's Information Economy and Society".
The Risks of Key Recovery, Key Escrow,and Trusted Third-Party Encryption: This is a very influential paper by some of the top cryptographers in the world: Hal Abelson, Ross Anderson, Steven M. Bellovin, Josh Benaloh, Matt Blaze, Whitfield Diffie, John Gilmore, Peter G. Neumann, Ronald L. Rivest, Jeffrey I. Schiller, Bruce Schneier.
Handbook of Applied Cryptography (CRC Press, 1996): Written by leading experts in Cryptography, Alfred Menezes, Paul van Oorschot, and Scott Vanstone, this handbook is a valuable reference for novices as well as experts.

Media Coverage:

Privacy in a computer age: Montreal Gazette, 28jul98, (Editorial)
It should be legit to computer encrypt: The Globe & Mail, 25jul98, (Editorial)
Privacy czar backs use of encryption software: Globe & Mail, 23jul98, (Jeff Sallot)
FBI Sweet on Crypto Proposal: Wired News, 19jul98, (James Glave)
U.S. Data-Scrambling Code Cracked With Homemade Equipment: New York Times, 17jul98, (John Markoff)
Code-breakers crack government-approved encryption standard: Associated Press, 17jul98
Fed Encryption Standard Exposed: Wired News, 17jul98
Group cracks crypto standard: c|net News, 17jul98, (Randy Westion)
Gates Outline [Crypto] Case to Reno: New York Times, 11jun98, (Jeri Clausing)
Encryption Debate Heats Up in Washington: New York Times, 09jun98, (Jeri Clausing)
Police want ready access to e-mail: Hamilton Spectator, 08jun98, (Jim Bronskill)
Crypto Kills -- Really, It Does: Wired News, 08jun98, (James Glave)
Crypto Kills -- Really, It Does: Wired News, 08jun98, (James Glave)
Lose the Keys: Ottawa Citizen, 22may98, (Editorial)
Cryptography battle heats up: Montreal Gazette, 06may98, (Matthew Friedman)
Encryption strategy flawed, group says: Toronto Star, 01may98, (K.K. Campbell)
Security on the Internet: CBC Radio, 28apr98, (Avril Benoit)
Net Encryption rules challenged: Hamilton Spectator, 28apr98, (David Akin)
Industry debates encryption policy: NetworkWorld, 24apr98, (Carol Neshevich)
Crypto free speech case in court: c|net News, 24apr98, (Courtney Macavinta)
Encryption issue hoists Ottawa onto a tightrope: Globe & Mail, 22apr98, (Geoffrey Rowan)
Encryption regulation pointless, experts say: c|net News, 20apr98, (Nathan Arnold)
Commerce Chief Calls U.S. Encryption Policy Flawed: New York Times, 16apr98, (Jeri Clausing)
U.S. Report Weighs Impact of E-Commerce: New York Times, 16apr98
Researchers crack GSM cell phones, suggest gov't weakened keys: Smartcard Developer Association, 13apr98
Industry asks: What price security?: Ottawa Citizen, 08apr98
Canada mulls liberal encryption exports: Electronic Commerce News, 07apr98, (Charles Flippen)
New Code May Foil Prying Police: Science, 03apr98
Net firms must assure privacy: Toronto Star, 03apr98, (Valerie Lawton)
Crypto Canucks: Hands Off Our Keys!: Wired News, 02apr98, (James Glave)
Cryptographers give government clear message: Ottawa Citizen, 01apr98, (James Bagnall)
Canadian IT vendors want no encryption export controls: InfoWorld Electric, 01apr98, (Elinor Mills)
Clear way for encryption export, Ottawa urged: c|net News, 31mar98, (Nathan Arnold)
Proposed policy changes causing angst: Computing Canada, 23mar98, (Greg Enright)
Keeping it secret - Feds try to get a grip on encryption policy: Canadian Press, 05mar98, (Jennifer Ditchburn)
Cracking the codes: Hamilton Spectator, 02mar98 (David Akin)
Canadian crypto covets US ruling: c|net News, 19dec97, (Sam Ladner)
Wiretapping probe urged: Toronto Star, 06oct97
CSIS has wiretap green light: Hamilton Spectator, 01oct97, (Jim Bronskill)
An attempt to define the five most important Privacy Issues: Le Devoir, 23sep97, (Michel Venne)
Speaking in codes: eye weekly, 07aug97, (Ingrid Hein)
It's the law vs. privacy in high-tech debate: Ottawa Citizen, 06aug97, (Charles Enman)
Can you keep a secret?: The Convergence, 02aug97, (David Jones)
Canadian Product Puts New Spin on Encryption Debate: New York Times, 01aug97, (Peter Wayner)
Spy agency hits free trade in scrambling technology: Associated Press, 30jul97, (Cassandra Burrell)
Entrust skirts export rules on encryption software: Globe & Mail, 29jul97, (Geoffrey Rowan)
CANARIE to secure Net payment with Mondex card: NetCASH, 10jul97, (Ray Van Eng)
Digital phones to block out eavesdroppers: Financial Post, 10jun97, (Deborah Stokes)

How to participate:

To participate in EFC's Golden Key Campaign, just follow these easy steps ...

Use the following HTML to display the EFC Golden Key icon on your own web page, with a link back to this web page. (If a black background looks better on web page, try "efccrypb.gif" instead of the transparent "efccrypt.gif")
```
<center>
<a href="http://www.efc.ca/pages/crypto/golden-key.html"
target="popup"><img alt="[EFC Golden Key - Strong Crypto]"
src="http://www.efc.ca/images/efccrypt.gif"
width=144 height=54 border=0></a>
</center>
```
Send an email message to goldenkey@efc.ca to let us know that you've joined the campaign! Be sure to include the URL for your web page.
Tell a friend, or two.

Here's our current list of participating web pages.

How to Join:

To join Electronic Frontier Canada as a supporting member, just fill out the online version of the EFC Membership Application Form.

EFC

Electronic Frontier Canada's Golden Key Campaign