re ideas on clipper jim gillogly jim mycroft rand org writes in article fpizbg wc qokyw andrew cmu edu you write suppose i knew how the algorithm worked and knew the n for my chip but did not know f then by cryptanalysis i might be able to determine f from if law enforcement field e e k u n f not knowing n would might make this much harder they re betting that you can t do this even if you know n even if you know e in fact which they re trying to keep secret if you can find e by grinding down the chip presumably you can find f as well but we can t do this right now with des even knowing the encryption method without doing almost the whole bit search that is not true with chosen plaintext attacks des keys can be determined without the full search now suppose that i know f either legitimately or not if i know k either because i am involved in the conversation or i know u for a party in the conversation i may now be able to determine u for the other party again they re betting that you can t find u given k i e they claim the encryption is strong trust us i am not willing to take that bet if i know f i can also defeat the law enforcement field since i could make my own with a different k then the one i am using knowing f also allows traffic analysis to be performed so i might not know what you are saying but i could know who you are saying it too i m not sure there ll be a way to shove arbitrary key and data through your chip but if so this part s ok we re assuming e is unknown you can obviously shove arbitrary data through your chip as for the key it is stated that the sesion key exchange is external to the chip so i can pick my keys too now i admit that someone trying to compute u will not have lots of messages to work from but since we have no way of knowing that the key generation method does not deliberately generate weak keys or for that matter that the published method is in fact used perhaps the u s will be chosen from know weak keys for the system they assume that you won t be able to find u no matter how many messages you have if they could break u they wouldn t need the key escrow bing bing bing bing bing that exactly my point since we cant know that they do not have this capability the only safe assumption is that they do i admit that most of my cryptographic complaints are probably unfounded but since we cant know one way or the other im not gonig to take their word for it obviously the compromise of f would be a disaster both to law enforcement for whom this whole thing is designed and for the people who believe that it is giving them security f is but one number and i sure that alot of people more then know what it is and if some panel of experts is going to check it over for flaws then many more will know f forget grinding chips bribery and blackmail work just fine it s not clear that the experts will be told f in fact i d be surprised i d expect something more of the form of the fips pub describing des so that they could look at the algorithm in general rather than with the specific set of keys chosen oh come on thats like saying you could evaluate des without the s box constants jon
