We are told that spies are reading SSL-encrypted messages at their leisure. We are also told that saboteurs have infiltrated international standards committees for the purpose of weakening crypto systems. This gives you indigestion? Don’t rely on security systems designed by committees! PKI is – and has always been – a sham. A cheap sham, at that. Consider the fact that Bitcoin, for all of its faults, gets by perfectly well without anything resembling PKI. Loudmouth activists, who put up such a ferocious fight against outright key escrow in the ’90s, ended up buying the very same wine in a different bottle with SSL and every other PKI-based faux-security system currently in use – where you are stuck with relying on a handful of con artists not to cough up the master keys to whomever they please.
Let’s go back to your kitchen. It is squeaky-clean, you say, because nowhere in your house do you make use of Microsoft’s miserable imitation of an operating system. Guess what, the mounds of garbage are still there, stinking brazenly; the mice leap, they play without fear, because virtually all of your cryptographic needs are serviced by some variant of OpenSSL. What a monstrous turd of a library! Have you read and understood it – any of it? Do you personally know a single living soul who has done so? Dare to contemplate the very idea of plowing through these megabytes of gnarly crapola. But let’s examine the reason for the bulk. The idiot ‘C Machines,’ and the few operating systems commonly used therein, are, one could almost say, criminally negligent in failing to provide any real support for most of the basic building blocks of modern computing: from bignum arithmetic to garbage collection. Authors of libraries like OpenSSL are to be applauded for their feat of creating something useful on top of this obscene Babel. But the result is always and inevitably a pile of garbage – comprehensible4 by no one, with plenty of hidey-holes for creepy crawlers of every species. Get the conceptual foundations right, and the vermin scurry away.
I for one am greatly surprised to see respectable men of science like Bruce Schneier calling for lawsuits and parliamentary hearings to rein in the snoops. The very notion of limiting the authority of a secret police agency via laws and regulations is laughable. Quis custodiet ipsos custodes? Who is going to bring down the law upon these fellows? You? Your neighbor? Mr. Schneier? The Pope? The Grand Inquisitor? 5
On top of it all, I fail to grasp the public’s anger at our cloak-and-dagger friends. It is much like hating the Public Executioner for chopping heads. It’s what he’s paid for! If you don’t care to be separated from your head, take some measures. Said measures could be political (bow in eternal fealty to your beloved Führer) or technological6. The one measure which is guaranteed not to work is whining.
Civilized society traditionally privileged certain professions – medicine, law, the priesthood – in return for certain obligations. A priest takes an oath not betray the seal of confession, and in return he is trusted with the most damning secrets. The doctor swears not to harm his patient, even when the latter has committed terrible crimes. The lawyer tries to defend miscreants he knows to be guilty. One clever soul suggested applying this doctrine to yet a fourth profession, creating a kind of “programmer priest.”
Perhaps one day there will indeed be someone you can trust to pronounce – truthfully and competently – that a crypto-system is strong, that a protocol has not been diddled, that your computer serves only a single master. But don’t hold your breath; today’s digital shaman will not help you; he is on the king’s payroll, and will speak the words he was ordered to speak by his liege-lord. And no seal of confession seals his lips. So if you want security, you will have to achieve it on your own: by using systems which you actually understand. All the way down to the silicon. These do not presently exist, but could be made to exist.
Bringing the comprehensible computer into existence is no easy task – but it is surely a considerably-easier (and ultimately more rewarding) task than trying to persuade the headsman to put down his ax and leave your head on its shoulders merely from the kindness of his heart (or because a piece of parchment, written long ago, proclaims that your head ought to stay attached.) Clean up the kitchen – banish the vermin. While you still can. Or learn to live with the squeaks, the ruined food, the dung.
