Subject: humo[u]r in law

From: "Peter Williams" <[email-masked]>
Date: Tue, 27 Jul 1999 13:24:07 -0700

"SEC. 14. FAILURE TO DECRYPT INFORMATION OBTAINED UNDER COURT ORDER. Whoever
is required by an order of any court to provide to the court or any other
party any information in such person's possession which has been encrypted
and who, having possession of the key or such other capability to decrypt
such information into the readable or comprehensible format of such
information prior to its encryption, fails to provide such information in
accordance with the order in such readable or comprehensible form"

If an certificate-bearing, encrypted S/MIME message
(BER-encoded) is encrypted under an S/MIME process,
and a party hands over the keying material necessary to
decrypt the payload to ANY court (including an International
court presumably), is the result "readable and comprehensible" - being
BER-encoded?

The corollary of this, if true, is that it would
define all BER-encoded data (such as certificates)
as having a readable and comprehensible format. This
has relevance to that debate which demands that consumers
have obtained "readable and comprensible" certificates
before they can be held to have truly accepted
a certificate.

Only following acceptance, in many law environments nowadays,
is the certificate valid, and only then can one
establish the validity of a certificate, and/or
the validity of a particular certificate chain.

---

From: Paul Koning <[email-masked]>
Date: Tue, 27 Jul 1999 16:18:18 -0400

>>>>> "Peter" == Peter Williams <[email-masked]> writes:

 Peter> If an certificate-bearing, encrypted S/MIME message
 Peter> (BER-encoded) is encrypted under an S/MIME process, and a
 Peter> party hands over the keying material necessary to decrypt the
 Peter> payload to ANY court (including an International court
 Peter> presumably), is the result "readable and comprehensible" -
 Peter> being BER-encoded?

 Peter> The corollary of this, if true, is that it would define all
 Peter> BER-encoded data (such as certificates) as having a readable
 Peter> and comprehensible format. This has relevance to that debate
 Peter> which demands that consumers have obtained "readable and
 Peter> comprensible" certificates before they can be held to have
 Peter> truly accepted a certificate.

I don't see a problem.  "Readable and comprehensible" doesn't have to
apply to the raw data; it's perfectly reasonable to rely on a tool.
For example, a tape recording of someone speaking in plain language
should be considered to meet those criteria, yet without a tape player 
it is a useless bit of plastic.

A somewhat related topic appears in US FCC regulations, part 97:
Amateur radio transmissions may not be encrypted (with a very small
limited exception).  For purposes of that rule, encodings that are
defined by readily accessible specifications and aren't intended to
obscure the contents are not considered "encryption"; the fact that
such an encoding may be complex and may require special decoding
apparatus to convert the signal into humanly-intellegible form is no
object. 

	paul