The Crypto Wars

The Crypto Wars is the name for a decades-long fight over who may use strong encryption and whether governments should be able to read what it protects. It's had several rounds: export controls that treated ciphers as weapons, a criminal investigation of the author of a free encryption program, a government-designed chip with a built-in escrowed key, a court case over whether source code is speech, and now repeated proposals that devices and messaging services provide "lawful access". We'll give the history in order, with dates, and set out each side's arguments the way its own advocates make them. This is a history, not a verdict. The technical facts are stated as facts, and the policy question is left to you.

The background: cryptography as a weapon

For most of the twentieth century cryptography belonged to governments. In the United States, encryption technology sat on the Munitions List as a Category XIII item, so exporting a cipher took the same kind of license as exporting a weapon, and Western allies coordinated export controls through CoCom, organized in 1949. That made sense while only militaries used strong ciphers. It stopped making sense in the 1970s, when the Data Encryption Standard was published (the history of AES) and public-key cryptography arrived (public-key cryptography was invented twice), and banks, businesses and individuals began needing strong encryption of their own.

PGP and the investigation, 1991 to 1996

In 1991 Phil Zimmermann released PGP (Pretty Good Privacy), which put public-key email encryption in the hands of anyone with a personal computer, with the source code freely available on the Internet. By one account it was the first widely available program implementing public-key cryptography. It spread around the world, and under the export rules that meant Zimmermann had exported munitions. The US Customs Service opened a criminal investigation into possible violations of the Arms Export Control Act. In 1995 Zimmermann answered by publishing the program's source code as a book, PGP Source Code and Internals. Books were protected speech and could be exported, and anyone abroad could scan the pages and compile the code. The government dropped the case without an indictment in early 1996. Zimmermann went on to found PGP Inc., and a standard, OpenPGP, grew out of the program.

Clipper, 1993 to 1996

The government's own answer to spreading encryption was a chip. Clipper, introduced in 1993 and designed by the NSA, implemented a classified cipher called Skipjack with an 80-bit key, and it carried a "Law Enforcement Access Field" that let agencies holding escrowed keys recover the session key under a court order. Manufacturers passed on it, and the only significant buyer of phones with the chip was the US Department of Justice. It also had a flaw. In August 1994 Matt Blaze published Protocol Failure in the Escrowed Encryption Standard, showing that the 16-bit hash protecting the access field could be defeated by brute force, so a user could keep the encryption and disable the escrow. A 1995 paper by Frankel and Yung found a second way, and in 1997 a group of cryptographers published The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption. By 1996 Clipper was defunct, and the NSA declassified Skipjack on June 24, 1998.

Export rules and the courts, 1990s

Meanwhile exporters were stuck with weak ciphers. In the mid-1990s the rules allowed a 40-bit key limit without an individual license, and Netscape's "International Edition" browser was cut down to 40 bits. Modest hardware can find a 40-bit key by exhaustive search. A machine costing less than $250,000 could search a 56-bit DES key, as the Electronic Frontier Foundation showed in 1998 with the machine in the AES history, and it published the design as a book for the same reason Zimmermann had. In 2015 the Logjam attack found servers still accepting "export-grade" 512-bit Diffie-Hellman, a legacy of those rules twenty years on (Diffie-Hellman).

Whether the rules were constitutional went to court in Bernstein v. United States. In 1995 Daniel J. Bernstein, then a student at Berkeley, challenged the requirement to get a license before publishing his encryption program's source code, and the Electronic Frontier Foundation later represented him. On April 15, 1996, Judge Marilyn Hall Patel ruled in the Northern District of California that the rules could be challenged on First Amendment grounds, and she followed with further opinions in December 1996 and 1997. On May 6, 1999, a three-judge panel of the Ninth Circuit held that source code is protected speech, but the court later ordered a rehearing and withdrew the opinion. The government revised the regulations more than once, and in October 2003 a renewed challenge to the revised rules was dismissed. The case never reached a final appellate judgment on the principle, but by then the rules had changed.

They changed in 1996, when Executive Order 13026 moved commercial encryption from the Munitions List to the Commerce Department's control list, and again in January 2000, when new rules greatly simplified the export of software containing cryptography, open-source programs included.

After 2000: Snowden and "going dark"

Export controls faded, and attention moved to access. In 2013 documents leaked by Edward Snowden described the NSA's Bullrun program, aimed at defeating encryption on the Internet, and The New York Times reported on the agency's efforts in September 2013. Commentators read some of the documents as pointing to specific algorithms and parameters, and those claims remain speculative in the public record. One verified episode involves a random-number generator standardized with an unexplained design, which NIST later withdrew (Dual_EC_DRBG). In 2014 Google and Apple redesigned their smartphone encryption so they could no longer unlock the devices themselves.

In February 2016 the FBI got a court order requiring Apple to help unlock an iPhone 5c from the San Bernardino attack. Apple challenged the order, and the FBI later hired a third party to break into the phone, so the legal question was never decided. In April 2016 Senators Feinstein and Burr introduced a bill. One account says it was likely to criminalize all forms of strong encryption, while others called its wording overly vague. In October 2017 Deputy Attorney General Rod Rosenstein called for "responsible encryption", which meant key escrow under another name. Other countries have made similar arguments since.

The two positions

• The case for lawful access. Law enforcement and intelligence agencies argue that strong, widely available encryption stops them from reading communications even when a court has authorized it, in investigations of terrorism, child exploitation and organized crime. They say rights aren't absolute, warrants have always existed, and companies should be able to comply with a lawful order.
• The case against. Cryptographers, security engineers and civil-liberties groups argue that nobody knows how to build access for the authorities that others can't also use. A key held in escrow is a target for theft, a mechanism is a flaw an adversary can hunt for, and the 1990s episodes show such schemes failing in practice. A 1997 report by a group of cryptographers, The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption, set out those technical risks. They also point out that anyone can download strong cryptography, so criminals can simply use it, while ordinary users carry the risk.

Cryptographers don't dispute the technical point, that a weakness made for one party can be found and used by another. Whether the benefit to investigations outweighs that cost is a political judgment, and people differ on it.

How cipher.ink fits in

The Crypto Wars are why a service like this can exist as ordinary open code. The site uses standard, publicly specified algorithms (AES-256-GCM, PBKDF2-HMAC-SHA256), sealed in your browser with no key held anywhere but in the passphrase or link you choose. The server couldn't hand over a readable message even if ordered to, because it has only ciphertext (client-side encryption, what the server sees). That's a technical fact about the design, not a legal position, and the design is open to inspection (the code), which is the lesson of Kerckhoffs's principle that the 1990s fights taught again.