re clipper considered harmful in article bb f c mizzou missouri edu c mizzou missouri edu john kelsey writes the clipper chip s user key is formed by r e d e n s s s r e d e n s s s r e d e n s s s why is the triple encrytion used is it just to gain an effective increase in keyspace to defeat a potential keysearch if so why use bit keys not knowing anything about the skipjack algorithm it s not really possible to guess whether this makes it harder or easier to guess s s why are n n and n formed as they are it would be facinating to see the skipjack algorithm to look for ways of attacking it that require three ciphertext blocks formed in that odd way where do the bit constant values that are concatenated with the serial number to form n n n come from are they changed from chip to chip or session to session even if they re published in the ny times if skipjack is resistant to known plaintext attacks when using triple encryption then there s no break in security but why allow that kind of weird format if those three bit values are truly random bits then maybe it s used to ensure that a known plaintext attack on skipjack if it exists can t be easily used to derive s and s for a whole production run of these chips i can t answer all our questions in detail but i can take a stab at them the form the operations that compute r r and r is of course the famous triple encryption suggested for use with des it s much stronger than a single encryption and has an effective key length of bits for reasons that were discussed when des was first standardized a simple double encryption would not have the same strength triple encryption has been used by ibm since more or less the beginning to encrypt other keys it s recommended for anything of very high value and i think we can agree that the r i and s i fit that description why n n and n well you need different plaintext values i have no idea if they ll be disclosed or not at a guess they re constructed so that they differ in as many bit positions as possible a goo cryptosystem will scramble things a lot with even a bit change but the values of n in a series will have fairly similar bit patterns and there might conceivably be a weakness so the n i values are and i m guessing chosen to increase the hamming distance in any event i m quite convinced that one cannot go back to the s i from the u i let alone u observe if the nsa has u they don t need to find s i but even if they do they can t get u and u in theory they should never even see those values even with a warrant the real question i think is why use this scheme at all as opposed to a hardware random number generator my answer is that this is much more verifiable look suppose that nsa nist the aclu the eff and the nra combined to build a really good random number generator and that it passed every test you could think of when you come back next week to program some more chips does it still work that well have any components changed in value have the components been changed out from under you does it still work well the in the presence of a focused microwave beam that tends to bias it towards selecting bits yes you can run detailed statistical tests on it again but that s hard consider on the other hand a software solution you bring your own floppies with you you can run cryptographic checksums etc it s a lot easier to verify that the software is unchanged in other words yes i can think of ways to cheat software too i think that they re a lot harder there are three issues with clipper the first is whether or not the architecture of the whole scheme is capable of working my answer with one significant exception is yes i really do think that nsa and nist have designed this scheme about as well as can be assuming that their real objectives are as stated to permit wiretapping under certain carefully controlled circumstances with a minimum risk of abuse the exception is that u exists outside of the chip on a programming diskette that s seriously wrong u and u should be loaded onto the chip separately to those who disagree and i don t claim my answer is obvious though i found my own reasoning sufficiently persuasive that i was forced to rewrite the conclusions section of my technical analysis paper i had originally blasted the scheme i issue this invitation assume that you were charged with implementing such a system with complete regard for civil rights and due process what would you do differently in answering this question please accept nsa s fundamental assumptions that both strong cryptography against outsiders and the ability to wiretap some domestic users is necessary if you feel it necessary to challenge those assumptions do it in the context of the last issue i present below right here i m discussing just the technical aspects and no i don t by any means claim that just because something can be done it should be the second issue is whether or not this whole architecture is actually going to be used just because clipper chips are made this way doesn t mean that that s the only way they ll be made maybe the nsa will substitute its own chips between the programming facility and the shipping dock and they ll generate bogus warrant requests so that the escrow agents don t wonder why they ve never called sorry guys all them terrorists and drug dealers and pedophiles seem to have bought triple des phones instead who d a thunk it i have no answer to this question and at the moment i don t see a way of answering it those concerns are part of my reasoning in my answer to the final question below the third and most serious issue is whether or not clipper is a good idea even if carried out strictly according to the letter of the law i think that the answer is no but it s not a no brainer i m a civil libertarian not a libertarian for reasons that i explained at great length on the net in the elder days and that i don t have the energy to repeat now but that means that i m willing to accept that some laws are necessary so long as they respect the essential rights of individuals the government already has the ability and in our system the right to issue search warrants and while that power has certainly been abused it s also been used quite properly and fairly in other cases is key escrow sufficiently different i think so but again it s not an easy question for me it is easy for libertarians to answer of course since clipper is completely alien to much of the rest of their oft admirable philosophy and it s also easy for those who give their unreserved trust to government a group i m much more distant from steve bellovin
