Practice Cryptography!

Currently, our practice with cryptography is a complete mess. We have organizations (such as the ITU, and the ISO) that push the concept of "single identity", without recognizing the anonymity aspects of that -- and creating standards (X.509, in particular) that technically and technologically reinforce this. We have Internet standards groups (S/MIME, SSL, TLS, etc) who are so concerned with maintaining compatibility with the ITU/ISO standards that they perpetuate this problem. We have OpenPGP, where we don't have any means of trusting that people already in the network are who they say they are without going to some huge geek convention. (By this, I mean "Linux Expo", "Symposium of the IEEE", and other... well, very geek-oriented convocations.) As well, even THAT promotes and promulgates the "single identity" concept. We have... well, we don't really have much else in the way of practical tools for communicating securely.

The notion of 'identity' is central to what's called the "Public Key Infrastructure" -- you have a private key, and I have the corresponding public key, but how do I know that you are who you say you are without having talked to you first, and you've shown me that you have the private key that goes with that public key? On top of that, how do I keep track of which public key belongs to whom, if I've got two hundred people who I correspond with, and a group of only ten or so that I correspond with on a regular basis? I can put your key in a database, and label it with your name in the same record... but what if I lose that database? What if someone comes in the middle of the night and raids my house to find out who I've been corresponding with?

Most concepts of "single identity" come down to "you have one identity, and a whole bunch of relationships that you can form." But what if I don't want my legal identity to be known to you? (It's a lot easier to steal my identity when you know what it is.) What if you don't need it, and it would actually put more liability on you if you knew it? (...such as Yahoo being forced to reveal the identity of someone who posted the contents of a Chinese Communist Platform document, which led to the person being sentenced to ten years in prison. see http://www.wired.com/news/technology/internet/0,70209-0.html for more information.)

What if I'm in the United States and exercising my right to anonymous free speech? I want you to know that I'm the same person who wrote the last comment, but I don't want to make my legal identity known (in case someone decides to stalk me or harass me because of the views I hold)?

What if you want the same thing?

How do we resolve this?

posted by Kyle H  # 4:30 PM 0 comments