The Risks of Key Recovery, Key Escrow, and Trusted Third-Party Encryption

H. Abelson, R. Anderson, S. Bellovin, J. Benaloh, M. Blaze, W. Diffie, J. Gilmore, P. Neumann, R. Rivest, J. Schiller, B. Schneier

ABSTRACT: A variety of "key recovery," "key escrow," and "trusted third-party" encryption requirements have been suggested in recent years by government agencies seeking to conduct covert surveillance within the changing environments brought about by new technologies. This report examines the fundamental properties of these requirements and attempts to outline the technical risks, costs, and implications of deploying systems that provide government access to encryption keys.

Revised 1998 version

Original 1997 paper: [full text - PDF (Acrobat)] [full text - Postscript]

This paper is also available in a Spanish translation by Arturo Quirantes.

Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.