facinating facts bit serial number possibly fixed s and s denning guvax acc georgetown edu vidkun abraham lauritz quisling writes each chip includes the following components the skipjack encryption algorithm f an bit family key that is common to all chips n a bit serial number u an bit secret key that unlocks all messages encrypted with the chip hmmm a thirty bit serial number and we are told the unit key u is derived deterministically from this serial number that means that there are only one billion possible unit keys to generate the unit key for a serial number n the bit value n is first padded with a fixed bit block to produce a bit block n s and s are then used as keys to triple encrypt n producing a bit block r r e d e n s s s similarly n is padded with two other bit blocks to produce n and n and two additional bit blocks r and r are computed r e d e n s s s r e d e n s s s r r and r are then concatenated together giving bits the first bits are assigned to u and the second bits to u the rest are discarded the unit key u is the xor of u and u u and u are the key parts that are separately escrowed with the two escrow agencies hmmm we must assume that generating the unit key u from the serial number n rather than generating it from a randomly selected u and u is an intentional way of assuring a fail safe for the government u is completedly determined given s s and n if s and s do not change they constitute effective master keys along with f the theft of which or the possession of which by various authorities completely obviates the security of the system however more interestingly we know for a fact that if s and s are fixed no matter what the keyspace for u is no more than why not pick u and u at random why this interesting restriction of they key space if it not to provide an additional back door i find it disturbing that at the very best my security is dependant on approximately bytes worth of information that could be written on the back of a napkin even if s and s change periodically the rationale behind this restriction in the size of the keyspace seems strange if one is assuming that the goal is security and makes perfect sense if the goal is an illusion of security if s and s do not change even if they remain secret i wonder if they can somehow be back derived given enough unit key serial number pairs we are assured that this cannot happen but no one understands how skipjack works outside of government officials and soon foreign intelligence services that gain the information via espionage presumably we will eventually have the information as well reverse engineering gets more and more advanced every year but by the time we know it may be too late as a sequence of values for u u and u are generated they are written onto three separate floppy disks the first disk contains a file for each serial number that contains the corresponding key part u the second disk is similar but contains the u values the third disk contains the unit keys u agent takes the first disk and agent takes the second disk the third disk is used to program the chips after the chips are programmed all information is discarded from the vault and the agents leave the laptop may be destroyed for additional assurance that no information is left behind none of this makes me feel the least bit secure the silly notion of destroying the laptop appears to be yet another bizarre distraction we all know that you can t read data from dram that has been turned off for more than a few moments on the other hand what we don t know is why there is a need to generate the unit keys from s and s in the first place other than to weaken the system we don t know if the agents in question would resist a million in cash a piece for their information its probably worth hundreds of million so you can make the bribe arbitrarily hard to resist and to tell you the truth doing this in a vault rather than in joe random tempest shielded room with a laptop computer seems like melodrama designed to make high school dropouts from peoria impressed but it does very little for most of the rest of us the protocol may be changed slightly so that four people are in the room instead of two the first two would provide the seeds s and s and the second two the escrow agents would take the disks back to the escrow agencies what would this provide lets say the escrow agencies are the aclu and the nra and their agents personally take back the disks and are always honest who cares the nsa must be laughing out loud because they have the algorithm to regenerate u given n and likely don t need to steal they keys as they effectively already have them perry metzger pmetzger shearson com laissez faire laissez passer le monde va de lui meme
