OPERATIONAL SECURITY OF UBIQUITOUS INFORMATION - Cyberwar-Netwar: Security in the Information Age - page 108

I think we need to see more of it, and I will tell you why. I am talking from a concept
of homeland security issues in the United States. Anytime you have the military in a
situation where they have to communicate with disaster response agencies such as the
fire service, the police or the Emergency Medical Teams, etc., the military does not want
to give civilian agencies their cryptography. So, it would make sense to have a secure
voice or secure communications network that is commercially available to local agencies
which can be distributed locally and still not proliferate otherwise higher classified type
systems.
Stanley : Just to respond specifically again on NATO devices. There is a standard
now, the Norwegian TC621. There was a competition in the US and Norway, the only
two to put forward devices. Italy have since tried to start again and can join. I do not
know if this is the full story as a lot of politics go on in Brussels. NATO is moving more
and more towards IP laser encryption. We also have devices that can be used for PfP
communications; one of these is Norwegian. We can swap different algorithms,
depending on the use. There is another Norwegian national algorithm they use locally;
there is the NATO algorithm and then algorithms that NATO can use with PfP nations.
So, what you said is exactly true. About using the civilian algorithms, the digital
signature for a long time was only DSA, partly because of patent restrictions on RSA, but
there was a worry within the NSA that RSA could be rewritten to be used for encryption
as well as signature whereas DSA was designed just for signature. As export restrictions
disappeared and as patents disappeared and as the key length got a bit restrictive, they
have taken a more pragmatic approach and RSA and the codes are now included in the
digital signature standard. On confidentiality algorithms a lot of this directly comes from
the US in the first place, which has a lot of money to invest in military crypto. And what
we are seeing is not going to go away. Their products are there and are being used. The
NSA may not have Shamir, but they have equivalent people sitting in a bunker
somewhere, developing these algorithms. So, we are going to carry on using hardware
crypto and specific government crypto for quite a time. But the NSA does have a
modernisation programme where they are trying to speed up crypto because it takes a
long time to develop and go through the approval process and they are slowly coming
round to the idea of modernisation.
Vellone : You mentioned IP encryption and that raises another important question
about the key management for this equipment. The problem is not with the hardware
equipment, but with the management of keys. At the moment there is only one indicator,
the Data and Electronic Key Management System (DEKMS), which is something that
overlaps with the national EKMS-Electronic Key Management System. The problem in
the future will be to have a PKI solution able to handle the key and transmit it using the
certificate, because something must be allowed at application level for transmission of
the key. So, today the protocol for this key management system is not completely
defined and there are a lot of problems still to be solved in the near future. In future there
might be a possibility for this equipment to inter-operate with other different kinds of
equipment.
Valente : Different countries have different polices, but in most NATO countries you
can use cryptography freely, and in some countries you cannot but people do actually use
it although it may not be legal. So, correct me if I am wrong here, but do we have a