No subject

Tue Apr 29 21:07:06 EDT 2003

.200.157])
	by red.metdow.com (Postfix) with ESMTP id 20BE3182FA9
	for <cryptography at metzdowd.com>; Tue, 29 Apr 2003 22:43:47 +0000 (UTC)
Received: from user-119ac86.biz.mindspring.com ([66.149.49.6])
	by tisch.mail.mindspring.net with esmtp (Exim 3.33 #1)
	id 19Adp2-0005EB-00; Tue, 29 Apr 2003 18:43:37 -0400
Mime-Version: 1.0
X-Sender:  Message-Id: <p05210678bad4afa239cc@[66.149.49.6]>
X-Clips-URL: <http://www.eweek.com/print_article/0,3668,a=3D40899,00.asp>
Date: Tue, 29 Apr 2003 18:40:51 -0400
To: Clippable <rah at shipwright.com>
From: "R. A. Hettinga" <rah at shipwright.com>
Subject: eWeek: Cryptography Guru Paul Kocher Speaks Out
Cc: cryptography at metzdowd.com
Content-Type: text/plain; charset=3D"iso-8859-1"
Content-Transfer-Encoding: 8bit
Message-Id: <E19Adp2-0005EB-00 at tisch.mail.mindspring.net>

<http://www.eweek.com/print_article/0,3668,a=3D40899,00.asp>

eWEEK

April 25, 2003=20
Cryptography Guru Paul Kocher Speaks Out=20

By=C2=A0 Dennis Fisher=20

SAN FRANCISCO=C2=8BAs the wave of acquisitions in the security industry
continues to mold innovation and original thought into a gray mass of
sameness and me-too product offerings, successful, independent
security companies are fast becoming a dying breed. One of the few
holdouts in this arena is Cryptography Research Inc., a small San
Francisco-based company that tackles difficult cryptographic issues
for a variety of high-end clients. The company is currently working on
a new copy-protection scheme for digital content that enables content
owners to control how the content is used. Paul Kocher, the company's
president, is considered one of the rising stars in the world of
cryptography, thanks to his design for the SSL v3.0 protocol and
development of a timing attack on the RSA algorithm. Senior Editor
Dennis Fisher sat down with Kocher and Benjamin Jun, the company's
vice president, at the RSA Conference last week to discuss the new
technology and why the current argument over mandated copy protection
is moot.

eWEEK: Can you tell me a bit about how your company is different from
most security companies?

Kocher: Our focus is to solve the hardest security problems that
people have. We do a lot of work with Hollywood studios. There have
been a lot of technologically poor proposals [regarding digital
piracy] that are in a lot of ways the worst of all worlds. They not
only don't solve the problem, they make it worse. We don't build
products or write huge pieces of software, but we can tackle the
really hard problems. We only have eight people, but it's a small shop
of really bright people.

eWEEK: Well, there probably aren't that many people who have the kind
of knowledge that you need.

Kocher: Yeah, we do see cryptography as a people problem and a
technical problem. Almost all of the technical problems in a
cryptosystem are the result of two people who designed different
blocks and didn't communicate with each other and then tried to put
them together.

Jun: Some of the people who we've hired, we hired for one reason and
then it turns out that they have a lot of knowledge in another very
specialized area that we weren't that excited about until we found an
application for it.

eWEEK: Do you see yourselves as having any direct competitors?=20

Kocher: I don't know. There's so much work to be done. The size of the
problem out there divided by the number of people working on it means
that there's a lot of work out there. There could be 50 times as many
people working on it and our focus still wouldn't be competitive.

Jun: Research is about failure. You try to get through all of the
wrong answers as quickly as possible so you can get to the right
one. We try to fail as quickly as possible, if that makes sense.

eWEEK: What would be the next big problem for you guys to tackle? Is
quantum cryptography something that you're interested in? I know
there's already been some successful work on quantum key generation.

Kocher: To me, quantum cryptography is useless. It purports to solve a
problem that's already solved. It is an interesting research problem,
though. But, you're not going to see quantum computers showing up to
do useful things probably in my lifetime and possibly never. But it is
the most interesting problem in computing in the last 30 years. It's
absolutely fascinating. But, of all the things that keep us awake at
night, that's way down there with alien invasions.

eWEEK: Tell me about the work you're doing on copy protection.=20

Kocher: The studios have real problems. Piracy is illegal, and my job
is to solve those security problems. Both sides in this debate are
missing the point. Mandating copy protection isn't realistic. The
hardware model doesn't work. In our technology, the player carries
software with it that runs in a virtual machine. The security is
player-centric and is associated with the content. So if the security
is broken, it's just one movie [that's compromised], not all of them.

eWEEK: I understand that you also found a way to trace illegal copies
back to their original owners.

Kocher: If you just use a watermark for forensic purposes, it can be
made provably secure. You can apply this to digital content. As
decryption occurs, we can encode little differences. Each player has
different keys and decrypts differently. The code in the content will
decide how that happens. If you copy it, we can trace it to the
original owner. Then the studio can take measures to prevent future
movies from playing in that player. We're building a
stalemate. Attackers will break the security, but then the content
owner can have countermeasures.

eWEEK: Have you had discussions with Hollywood about this?=20

Kocher: We're talking to some studios now. It takes time. It's 20,000
people who all have different opinions. But once we can show them how
the technology can work for them, they usually get it.

--=20
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com