[2965] in cryptography@c2.net mail archive
Re: IETF building GAK into the PKI
daemon@ATHENA.MIT.EDU (Adam Back)
Tue Jul 14 18:24:04 1998
Date: Tue, 14 Jul 1998 23:03:50 +0100
From: Adam Back <aba@dcs.ex.ac.uk>
To: perry@piermont.com
CC: smb@research.att.com, cryptography@c2.net
In-reply-to: <199807142035.QAA05397@jekyll.piermont.com> (perry@piermont.com)
Perry writes:
> Steve Bellovin writes:
> > Perry, I keep seeing stories in the Wall Street Journal about
> > brokerage firms -- in an attempt to comply with their perception of
> > SEC regulations -- monitoring employee email via assorted automated
> > systems. Might they be customers for communications key access?
>
> This is actually the one area I've hit where some communications
> interception is needed, but it is very limited.
>
> This is really all an extension of the old line practice of
> recording conversations made by traders to settle disputes and
> assure that information isn't lost.
>
> [key recovery doesn't achieve this user requirement]
With such a user requirement I would presume that the model is that
users are not permitted to modify or install additional software on
trading machines. With this threat model one alternative is to
archive the data as it is decrypted, and before it is encrypted.
Another method might be to have an encryption/decryption server which
decrypted all traffic as it arrived at the company. Adds some risks,
but if you really want access to all the incoming and outgoing data,
this is what it ammounts to.
Would be interested in Perrys comments on how this is done in
practice.
Adam
