On the hOrizOn

S teven Levy’s fascinating 2001 book Crypto has the subtitle How the Code Rebels Beat the Government, Saving Privacy in the Digital Age.1 The “code rebels”—a loose coalition of academics, hobbyists, and civil-liberties organizations— did indeed beat the government, causing the earlier restrictions on distribution of cryptographic tools to be largely abandoned. However, this victory seems to have done miserably little to save privacy. In fact, you might look at the early 2000s as the years when digital privacy took a nosedive. Why did Levy and many other observers get it so wrong back then? For over 2,000 years, evidence seemed to support Edgar Allan Poe’s assertion, “human ingenuity cannot concoct a cypher which human ingenuity cannot resolve,” implying a cat-and-mouse game with an advantage to the party with more skills and resources. This changed abruptly in the 1970s owing to three separate developments: the symmetric cipher DES (Data Encryption Standard), the asymmetric cipher RSA, and Diffie-Hellman key exchange. For the first time, it was conceivable that someone with modest computing resources could encrypt a message in a way that would resist attack by governments, as long as the key was secret. For the first time, some encryption algorithms came with clear mathematical evidence (albeit not proofs) of their strength. These developments came on the eve of the microcomputing revolution, and computers were gradually coming to be seen as tools of empowerment and autonomy rather than instruments of the state. These were the seeds of the “crypto dream.”