From: “Dan Kaminsky” <dankamin@cisco.com> To: “Jon Winters” <winters@obscurasite.com>; “Whitney Broussard” <Whitney@smmmusiclaw.com> Cc: <pho@onehouse.com>; <hardware@obscurasite.com> Subject: Pho: Cryptography Doesn’t Save Napster, and The War Over Parodies Date: Monday, February 12, 2001 6:55 PM

> If the IP is _music_ and the encrypted file is _noise_ then you’re in the > clear.

A couple people have been talking about how cryptography is a magic salve for Napster.

It’s not even close.

The entire concept of Napster is that anyone can play the music, with absolutely no difficulty. Transfers are anonymous; there’s no way to know that the person you’re giving the data to isn’t an enforcement agent. If a peer can play it, so can the warden. If a peer can decrypt it, so can the warden.

And if the warden *can’t* decrypt it…don’t look for the peer to. Now, if peers aren’t anonymous, you actually have something–the Aimster model actually does something, because you can differentiate the warden from your peers. But Napster has no ability to differentiate.

What’s funny is, if it did have the ability to differentiate, through a distributed cryptographic reputation engine…suddenly you’d have a hell of a way to convict someone–look at all those nice digital signatures signing somebody’s guilt 🙂

Look. Link oriented crypto is very useful for circumventing link based censorship(port/content blocking). It does nothing when one of the endpoints is possibly untrusted. File oriented crypto is similarly unsuitable, and both are ultimately defeated by the fact that the indexes that make the system useful are the ultimate point of failure. Either entries are trusted, and thus are centrally destructable, or are untrusted, and thus are globally spoofable.

Now, what’s going to be really, really interesting to watch is what happens to PARODIES on Napster. Think about it for a moment–what if the only way to listen to Britney is to hear “her” blast her own record company. Media companies for years have been trying to figure out how to shut down criticism; the ever-ignored software IP lawyers have even bug trying to include anti-criticism clauses into their EULA’s. With Napster on the ropes, and song parodies an effectively viral source of criticism…I’m quite curious to see exactly what would become of a major-label free Napster.

Talk about a reversal of fortune: If people are looking for your material, would you rather they find it, or something even worse?

Yours Truly,

Dan Kaminsky, CISSP