re clipper considered harmful in article apr ulysses att com smb research att com steven bellovin writes there are three issues with clipper the first is whether or not the architecture of the whole scheme is capable of working my answer with one significant exception is yes i really do think that nsa and nist have designed this scheme about as well as can be assuming that their real objectives are as stated to permit wiretapping under certain carefully controlled circumstances with a minimum risk of abuse the exception is that u exists outside of the chip on a programming diskette that s seriously wrong u and u should be loaded onto the chip separately to those who disagree and i don t claim my answer is obvious though i found my own reasoning sufficiently persuasive that i was forced to rewrite the conclusions section of my technical analysis paper i had originally blasted the scheme i issue this invitation assume that you were charged with implementing such a system with complete regard for civil rights and due process what would you do differently in answering this question please accept nsa s fundamental assumptions that both strong cryptography against outsiders and the ability to wiretap some domestic users is necessary if you feel it necessary to challenge those assumptions do it in the context of the last issue i present below right here i m discussing just the technical aspects and no i don t by any means claim that just because something can be done it should be ok steve here s a sketch of an alternative that i believe addresses most of the objections to the clipper scheme notation concatenation exclusive or e m k message m encrypted by key k d m k message m decrypted by key k h m hash digest signature of message m important values u x local chip unit key from escrow agency x u x remote chip unit key from escrow agency x n serial number of the local chip n serial number of the remote chip a number of escrow agencies k k session keys agreed upon external to this protocol f family key need not be secret protocol choose k k a such that k k k a remote chip does same for k k k a compute the following l e k u l a e k a u a l n e n l l a f remote chip does the same for l l a l send l to remote chip and receive l from remote chip compute ke h k n l l a k d l f kd h k d l f k n l l a note that d l f n l l a remote chip does the same for ke and kd user data is encrypted decrypted with keys ke ke kd kd assumptions no trap doors in e d and h h is not invertible algorithms for e d and h are secret otherwise a software implementation bogus chip could communicate with a real chip the chip only supports the following operation return n load k x return e k x u x return e n l l a f given e n l l a f return n l l a load k given e n l l a f compute ke kd given m return e m ke given m return d m kd anything programmed into the chip can be determined by destroying the chip u u a f n u u a can not be determined except by destroying the chip unfortunately this may not be true in reality i suppose it s possible to determine how a chip has been programmed with a sophisticated sp x ray machine to look for blown fuses the u s are programmed independantly by the escrow agencies notes for tapping escrow agency y is given n e k y u y n e k y u y and returns k y k y lea s must contact all escrow agencies with the serial numbers from both chips and the encrypted partial keys this allows the agencies to record that both chips were tapped lea s only get the session key not the key to all conversations of a particular chip this precludes real time decrypting of a conversation but that isn t one of the stated requirements observation in order for any secure by tap able communication scheme to work the active parts need to share a secret and if this secret is revealed communications by those that know the secret can be made un tap able obvious candidates are the cryptographic algorithm and the master family key relative size and complexity suggests that the key can be obtained from a silicon implementation of the scheme a lot easier and faster than the algorithm rsbx raymond s brand rbrand usasoc soc mil
