revised technical summary of clipper chip here is a revised version of my summary which corrects some errors and provides some additional information and explanation the clipper chip a technical summary dorothy denning revised april introduction on april the president announced a new initiative that will bring together the federal government and industry in a voluntary program to provide secure communications while meeting the legitimate needs of law enforcement at the heart of the plan is a new tamper proof encryption chip called the clipper chip together with a split key approach to escrowing keys two escrow agencies are used and the key parts from both are needed to reconstruct a key chip contents the clipper chip contains a classified single key bit block encryption algorithm called skipjack the algorithm uses bit keys compared with for the des and has rounds of scrambling compared with for the des it supports all des modes of operation the algorithm takes clock ticks and in electronic codebook ecb mode runs at mbits per second each chip includes the following components the skipjack encryption algorithm f an bit family key that is common to all chips n a bit serial number this length is subject to change u an bit secret key that unlocks all messages encrypted with the chip the chips are programmed by mykotronx inc which calls them the myk the silicon is supplied by vlsi technology inc they are implemented in micron technology and will initially sell for about each in quantities of or more the price should drop as the technology is shrunk to micron encrypting with the chip to see how the chip is used imagine that it is embedded in the at t telephone security device as it will be suppose i call someone and we both have such a device after pushing a button to start a secure conversation my security device will negotiate an bit session key k with the device at the other end this key negotiation takes place without the clipper chip in general any method of key exchange can be used such as the diffie hellman public key distribution method once the session key k is established the clipper chip is used to encrypt the conversation or message stream m digitized voice the telephone security device feeds k and m into the chip to produce two values e m k the encrypted message stream and e e k u n f a law enforcement field which are transmitted over the telephone line the law enforcement field thus contains the session key k encrypted under the unit key u concatenated with the serial number n all encrypted under the family key f the law enforcement field is decrypted by law enforcement after an authorized wiretap has been installed the ciphertext e m k is decrypted by the receiver s device using the session key d e m k k m chip programming and escrow all clipper chips are programmed inside a scif secure compartmented information facility which is essentially a vault the scif contains a laptop computer and equipment to program the chips about chips are programmed during a single session the scif is located at mykotronx at the beginning of a session a trusted agent from each of the two key escrow agencies enters the vault agent enters a secret random bit value s into the laptop and agent enters a secret random bit value s these random values serve as seeds to generate unit keys for a sequence of serial numbers thus the unit keys are a function of secret random bits where each agent knows only to generate the unit key for a serial number n the bit value n is first padded with a fixed bit block to produce a bit block n s and s are then used as keys to triple encrypt n producing a bit block r r e d e n s s s similarly n is padded with two other bit blocks to produce n and n and two additional bit blocks r and r are computed r e d e n s s s r e d e n s s s r r and r are then concatenated together giving bits the first bits are assigned to u and the second bits to u the rest are discarded the unit key u is the xor of u and u u and u are the key parts that are separately escrowed with the two escrow agencies as a sequence of values for u u and u are generated they are written onto three separate floppy disks the first disk contains a file for each serial number that contains the corresponding key part u the second disk is similar but contains the u values the third disk contains the unit keys u agent takes the first disk and agent takes the second disk thus each agent walks away knowing an bit seed and the bit key parts however the agent does not know the other bits used to generate the keys or the other bit key parts the third disk is used to program the chips after the chips are programmed all information is discarded from the vault and the agents leave the laptop may be destroyed for additional assurance that no information is left behind the protocol may be changed slightly so that four people are in the room instead of two the first two would provide the seeds s and s and the second two the escrow agents would take the disks back to the escrow agencies the escrow agencies have as yet to be determined but they will not be the nsa cia fbi or any other law enforcement agency one or both may be independent from the government law enforcement use when law enforcement has been authorized to tap an encrypted line they will first take the warrant to the service provider in order to get access to the communications line let us assume that the tap is in place and that they have determined that the line is encrypted with the clipper chip the law enforcement field is first decrypted with the family key f giving e k u n documentation certifying that a tap has been authorized for the party associated with serial number n is then sent e g via secure fax to each of the key escrow agents who return e g also via secure fax u and u u and u are xored together to produce the unit key u and e k u is decrypted to get the session key k finally the message stream is decrypted all this will be accomplished through a special black box decoder capstone the next generation a successor to the clipper chip called capstone by the government and myk by mykotronx has already been developed it will include the skipjack algorithm the digital signature standard dss the secure hash algorithm sha a method of key exchange a fast exponentiator and a randomizer a prototoype will be available for testing on april and the chips are expected to be ready for delivery in june or july acknowledgment and distribution notice this article is based on information provided by nsa nist fbi and mykotronx permission to distribute this document is granted
