Encryption: the expert's view

---

Eminent cryptographer Ross Anderson, who has worked with the police on encryption cases and is head of the computer security group at Cambridge University, believes the holding of keys to coded data by Trusted Third Parties is unsafe and and an impractical solution.

In a submission to the Commons' Trade and Industry Select Committee in March, he said industrial uses of cryptography were now dominant with the public encountering encryption in cash machines, electricity meters, burglar alarms, mobile phones, tv set-top boxes and Web browsers when shopping on the Net.

In almost every case, the aim was to prevent fraud and there was no tension with law enforcement. Laws that make it more expensive to use cryptography, he argues, will harm consumers and have a directly adverse affect on crime prevention.

Consumer rights jeopardised

He says consumer rights would be affected by legislation that recognised that electronic signatures were valid if they were issued by the proposed licensing bodies.

Those who are victims of electronic fraud would then find it harder to prove their cases. It is certain that electronic signatures will be open to forgery and manipulation, he says.

He says a policy of key escrow - placing the keys to encrypted data with Trusted Third Parties - would have to be global to be effective and there is no prospect of this.

A paper he refers to by Professor Henry Beker and encryption consultant Chris Amery says: "What the UK government would like to see is some sort of international agreement on an acceptable level of intervention and surveillance in support of law enforcement and on a multilateral framework to achieve it.

"But the difficulties of achieving that are so great that unilateral action may be required. The more challenging problem is whether there is any way in which the objectives of the law enforcement authorities can be achieved in practice."