clipper chip technical details i received the following two notes from martin hellman with details on how clipper will work they are posted with his permission the implications of some details are fascinating date sat apr pdt from martin hellman hellman isl stanford edu to a long list of recipients subject clipper chip most of you have seen the announcement in friday s ny times etc about nist national institute of standards technology announcing the clipper chip crypto device several messges on the net have asked for more technical details and some have been laboring under understandable misunderstandings given the lack of details in the news articles so here to help out is your friendly nsa link me i was somewhat surprised friday to get a call from the agency which supplied many of the missing details i was told the info was public so here it is the cc of this to dennis branstad at nist is mostly as a double check on my facts since i assume he is aware of all this please let me know if i have anything wrong the clipper chip will have a secret crypto algorithm embedded in silicon each chip will have two secret bit keys one will be the same for all chips ie a system wide key and the other will be unit specific i don t know what nist and nsa will call them but i will call them the system key sk and unit key uk in this message the ic will be designed to be extremely difficult to reverse so that the system key can be kept secret aside it is clear that they also want to keep the algorithm secret and in my opinion it may be as much for that as this stated purpose the unit key will be generated as the xor of two bit random numbers k and k uk k k which will be kept by the two escrow authorities who these escrow authorities will be is still to be decided by the attorney general but it was stressed to me that they will not be nsa or law enforcement agencies that they must be parties acceptable to the users of the system as unbiased when a law enforcement agency gets a court order they will present it to these two escrow authorities and receive k and k thereby allowing access to the unit key uk in addition to the system key each user will get to choose his or her own key and change it as often as desired call this key plain old k when a message is to be sent it will first be encrypted under k then k will be encrypted under the unit key uk and the serial number of the unit added to produce a three part message which will then be encrypted under the system key sk producing e e m k e k uk serial number sk when a court order obtains k and k and thence k the law enforcement agency will use sk to decrypt all information flowing on the suspected link aside it is my guess that they may do this constantly on all links with or without a court order since it is almost impossible to tell which links over which a message will flow this gives the agency access to e m k e k uk serial number in the above message they then check the serial number of the unit and see if it is on the watch list for which they have a court order if so they will decrypt e k uk to obtain k and then decrypt e m k to obtain m i am still in the process of assessing this scheme so please do not take the above as any kind of endorsement of the proposed scheme all i am trying to do is help all of us assess the scheme more knowledgably but i will say that the need for just one court order worries me i would feel more comfortable though not necessarily comfortable if two separate court orders were needed one per escrow authority while no explanation is needed the following story adds some color in researching some ideas that silvio micali and i have been kicking around i spoke with gerald gunther the constitutional law expert here at stanford and he related the following story when edward levi became pres ford s attorney general right after watergate he was visited by an fbi agent asking for the wiretap authorizations when levy asked for the details so he could review the cases as required by law the agent told him that his predecessors just turned over blank signed forms every time levi did not comply and changed the system but the lesson is clear no single person or authority should have the power to authorize wiretaps or worse yet divulging of personal keys sometimes he or she will be an edward levi and sometimes a john mitchell martin hellman date sun apr pdt from martin hellman hellman isl stanford edu to smb research att com subject re clipper chip it is fine to post my previous message to sci crypt if you also post this message with it in which i ask recipients to be sparse in their requesting further info from me or asking for comments on specific questions by this posting i apologize for any messages i am unable to respond to i already spend too much time answering too much e mail and am particularly overloaded this week with other responsibilities i note a probably correction sent to me by dorothy denning she met with the person from nsa that i talked with by phone so her understanding is likely to better than mine on this point where i said the transmitted info is e e m k e k uk serial number sk she says the message is not double encrypted the system key or family key as she was told it is called only encrypts the serial number or the serial number and the encrypted unit key this is not a major difference but i thought it should be mentioned and thank her for bringing it to my attention it makes more sense since it cuts down on encryption computation overhead
