basic crypto requirements in order to have formulate a rational position on what cryptography policies are acceptable we must set forth a list of basic requirements i would propose the following as a starting point the algorithm must be publicly known and must have a record of surviving attempts by outside experts to find weaknesses the system implementation must make it possible to verify that the advertised algorithm is in fact the one that is being used the key must be quickly changeable by the user and must be of a sufficient length and complexity to defeat any brute force search possible now or in the reasonably near future note that these requirements are not incompatible with some form of key escrow system the may issue of byte describes an example of an encryption system which can clearly be implemented in a manner consistent with the above requirements while requiring that parts of the key be escrowed in order to have one s public key listed by a central distributor
