re inventing crypto policy an eff statement april initial eff analysis of clinton privacy and security proposal the clinton administration today made a major announcement on cryptography policy which will effect the privacy and security of millions of americans the first part of the plan is to begin a comprehensive inquiry into major communications privacy issues such as export controls which have effectively denied most people easy access to robust encryption and law enforcement issues posed by new technology however eff is very concerned that the administration has already reached a conclusion on one critical part of the inquiry before any public comment or discussion has been allowed apparently the administration is going to use its leverage to get all telephone equipment vendors to adopt a voice encryption standard developed by the national security agency the so called clipper chip is an bit split key escrowed encryption scheme which will be built into chips manufactured by a military contractor two separate escrow agents would store users keys and be required to turn them over law enforcement upon presentation of a valid warrant the encryption scheme used is to be classified but the chips will be available to any manufacturer for incorporation into its communications products this proposal raises a number of serious concerns first the administration has adopted a solution before conducting an inquiry the nsa developed clipper chip may not be the most secure product other vendors or developers may have better schemes furthermore we should not rely on the government as the sole source for the clipper or any other chips rather independent chip manufacturers should be able to produce chipsets based on open standards second an algorithm cannot be trusted unless it can be tested yet the administration proposes to keep the chip algorithm classified eff believes that any standard adopted ought to be public and open the public will only have confidence in the security of a standard that is open to independent expert scrutiny third while the use of the use of a split key dual escrowed system may prove to be a reasonable balance between privacy and law enforcement needs the details of this scheme must be explored publicly before it is adopted what will give people confidence in the safety of their keys does disclosure of keys to a third party waive an individual s fifth amendment rights in subsequent criminal inquiries these are but a few of the many questions the administrations proposal raised but fails to answer in sum the administration has shown great sensitivity to the importance of these issues by planning a comprehensive inquiry into digital privacy and security however the clipper chip solution ought to be considered as part of the inquiry and not be adopted before the discussion even begins details of the proposal escrow the bit key will be divided between two escrow agents each of whom hold bits of each key the manufacturer of the communications device would be required to register all keys with the two independent escrow agents a key is tied to the device however not the person using it upon presentation of a valid court order the two escrow agents would have to turn the key parts over to law enforcement agents according to the presidential directive just issued the attorney general will be asked to identify appropriate escrow agents some in the administration have suggested that one non law enforcement federal agency perhaps the federal reserve and one non governmental organization could be chosen but there is no agreement on the identity of the agents yet classified algorithm and the possibility of back doors the administration claims that there are no back doors means by which the government or others could break the code without securing keys from the escrow agents and that the president will be told there are no back doors to this classified algorithm in order to prove this administration sources are interested in arranging for an all star crypto cracker team to come in under a security arrangement and examine the algorithm for trap doors the results of the investigation would then be made public the clipper chipset was designed and is being produced and a sole source secret contract between the national security agency and two private firms vlsi and mycotronx nsa work on this plan has been underway for about four years the manufacturing contract was let months ago government as market driver in order to get a market moving and to show that the government believes in the security of this system the feds will be the first big customers for this product users will include the fbi secret service vp al gore and maybe even the president at today s commerce department press briefing a number of people asked this question though why would any private organization or individual adopt a classified standard that had no independent guaranty of security or freedom from trap doors comprehensive policy inquiry the administration has also announced that it is about to commence an inquiry into all policy issues related to privacy protection encryption and law enforcement the items to be considered include export controls on encryption technology and the fbi s digital telephony proposal it appears that the this inquiry will be conducted by the national security council unfortunately however the presidential directive describing the inquiry is classified some public involvement in the process has been promised but they terms have yet to be specified from more information contact jerry berman executive director jberman eff org daniel j weitzner senior staff counsel djw eff org full text of the press releases and fact sheets issued by the administration will be available on eff s ftp site danny weitzner senior staff counsel eff
