Hacker News Reader

Comment by lliamander | Hacker News Reader

RE: Government Treating Crypto like munitions -

I'm curious, from anyone who knows about this stuff, is the argument in https://www.xkcd.com/504/ valid? I.E. could crypto be protected under the Second Amendment? To my IANAL eyes, it seems to me to be a completely legitimate argument.

View on HN

In the alt text of that comic, Munroe says "Jefferson would have been all about crypto."

A quick Google search confirms: not only would he have used crypto, he did use crypto:

> Jefferson had used ciphers before with official as well as unofficial correspondence; letters to James Madison, John Adams, James Monroe, Robert Livingston, among others include communication in cipher. It was a way to keep "matters merely personal to ourselves" as well as a way to "have at hand a mask for whatever may need it."

https://www.monticello.org/site/jefferson/jeffersons-cipher-...

The second amendment only applies to stuff that happens within the US. You have to file paperwork to transmit things like gun schematics over national borders, which is why plans for the Liberator pistol got pulled from the main site in a couple days and are now shared mostly through torrent sites.

However, crypto not being a munition means that a good argument could be made that it is speech, and therefore falling under the much more firmly challenged and discussed First Amendment, so restricting crypto could be considered a prior restraint.

Makes sense. So, hypothetically, if crypto was used within US borders (e.g. I encrypt my hard drive) and no algorithms were shared across national borders, then one could attempt a Second Amendment defense (assuming it was still labeled as munitions)?

I can see how recognizing it as speech and protecting it under the First Amendment would be superior.

Thanks!

Even without this cross-border thing, there are tons of regulations about what kind of weaponry you can have, and I don't think anyone argues that the 2nd amendment would allow anyone unlimited access to bazookas or nuclear weapons. Presumably if cryptography were treated as munitions, they'd argue that you can have access to some cryptography, but not "military grade cryptography".

Heller v. DC found that citizens may own arms in "common use."

RSA-2048 is definitely in "common use."

Right but that logic could be used to prevent mass adoption of better crypto. Brand new crypto is not in "common use". We could, for instance, see the state ban the use of quantum-resistant algorithms by private citizens if citizens are only allowed to use the crypto that is in common use.

Which is useful for today, but not necessarily tomorrow.

The law has not treated new weapons in private hands (ie. explosives, automatic weapons, etc) favorably.

RSA-2048 will be the small arms equivalent of a musket in 2040. Since the US government controls so much of the global brainpower for crypto, that's not a standard that is acceptable.

I will politely disagree. RSA-2048 implemented properly, on its own, has a significant security margin today and it's unlikely that HW advances over the next 25 years will erode that, even at a superbly-funded first-world intelligence agency.

I am not saying that they won't be able to pwn you; just that they won't do so by directly cracking 2k+ RSA.

The point is that crypto is only evaluated as "secure" at a given point in time.

Even if RSA-2048 is secure in 25 years, it will almost certainly not be in the same place in it's lifecycle. Even today, NSA guidance recommends RSA-3072, or RSA-2048 with an accelerated migration to Quantum-resistant crypto in the future. (https://www.nsa.gov/ia/programs/suiteb_cryptography)

My fear is that there won't be an "AES 2", and the commercial/individual world will return to a place where we don't have access to quality, trustworthy crypto for communications and commerce. Without security, there is no trust, and without trust many of the advances in productivity and and collaboration that we've gained in the last 20 years will be substantially weakened.

The second amendment applies to arms, not to munitions directly. At the time of its authoring, "arms" was understood to mean devices used by one person for the purpose of targeting one person or thing.

It have never, for example, applied to ordnance. (hence, the asinine argument "where does it end - should we allow everyone to have nukes?!" does make any sense, at least politically)

I've always believed (and have understood to be the consensus from legal references I've seen in the past) that the definition of taking up arms was related to their use to defend oneself against an oppressive opponent. Is that not how it is seen in the courts?

Shame all those privateers with cannons were running around obliterating your argument

> At the time of its authoring, "arms" was understood to mean devices used by one person for the purpose of targeting one person or thing.

It also meant cannons (which are crew-served), and up through the War of 1812 and beyond, privateers owned the vast majority of them.

So, I've not been able to actually dig up an answer to this:

Were cannons protected by the 2nd amendment? Or merely not prohibited in a legal environment in which the government claimed the authority to prohibit them?

I can't find any reference to discussion of cannons as "bearing arms."

As far as I understand https://en.wikipedia.org/wiki/Bernstein_v._United_States

>the Ninth Circuit Court of Appeals ruled that software source code was speech protected by the First Amendment and that the government's regulations preventing its publication were unconstitutional

So at least the implementation of crypto in software seems to be protected under the First Amendment.

Didn't the MPAA/DeCSS case (that happened after this) just route around this whole precedent using the DMCA and still end up making that source code illegal to distribute or use?

I remember some of the expert testimony presenting versions of the source code as all kinds of speech (someone even wrote a song I think) to make the point that code should be protected, but in the end they still lost the overall case.

It's one thing to classify code as speech, it's another thing to give it complete protection from censorship or criminalization in any scenario.

According to John Gilmore, when the EFF published the book about the "Deep Crack" DES cracker hardware titled "Cracking DES: Secrets of Encryption Research, Wiretap Politics, and Chip Design" [1], the US Government would not allow them to publish the software source code on a floppy or CDROM along with the book, because the export control laws considered DES software in machine readable form to be a munition.

However, they figured out that First Amendment protected their free speech to the extent that they were allowed to publish human readable listings of their source code in the book, even though a floppy disk was right out.

So just for that book, they invented a machine readable easy-to-scan "paper floppy disk" system that printed hex checksums of each line in the left column (which coincidentally looked enough like line numbers that it flew under the radar unnoticed), so you could scan and OCR the source code and checksums from the book, then validate it against the checksums to correct all the scanning errors.

> "Cracking DES" has been published only in print because US export controls on encryption make it a crime to publish such information on the Internet, but the book is designed to be easy to scan into computers. (EFF is also sponsoring a lawsuit by Professor Daniel Bernstein to overturn the law and regulations that make Internet publication of such research results illegal. The case now rests with the Ninth Circuit Court of Appeals.) [2]

[1] https://w2.eff.org/Privacy/Crypto/Crypto_misc/DESCracker

[2] http://www.oreilly.com/pub/pr/584

Reply on news.ycombinator.com