the clipper chip a technical summary the following document summarizes the clipper chip how it is used how programming of the chip is coupled to key generation and the escrow process and how law enforcement decrypts communications since there has been some speculation on this news group about my own involvement in this project i d like to add that i was not in any way involved i found out about it when the fbi briefed me on thursday evening april since then i have spent considerable time talking with the nsa and fbi to learn more about this and i attended the nist briefing at the department of commerce on april the document below is the result of that effort dorothy denning the clipper chip a technical summary dorothy denning april introduction on april the president announced a new initiative that will bring together the federal government and industry in a voluntary program to provide secure communications while meeting the legitimate needs of law enforcement at the heart of the plan is a new tamper proof encryption chip called the clipper chip together with a split key approach to escrowing keys two escrow agencies are used and the key parts from both are needed to reconstruct a key chip structure the clipper chip contains a classified bit block encryption algorithm called skipjack the algorithm uses bit keys compared with for the des and has rounds of scrambling compared with for the des it supports all des modes of operation throughput is mbits a second each chip includes the following components the skipjack encryption algorithm f an bit family key that is common to all chips n a bit serial number u an bit secret key that unlocks all messages encrypted with the chip encrypting with the chip to see how the chip is used imagine that it is embedded in the at t telephone security device as it will be suppose i call someone and we both have such a device after pushing a button to start a secure conversation my security device will negotiate a session key k with the device at the other end in general any method of key exchange can be used the key k and message stream m i e digitized voice are then fed into the clipper chip to produce two values e m k the encrypted message stream and e e k u n f a law enforcement block the law enforcement block thus contains the session key k encrypted under the unit key u concatenated with the serial number n all encrypted under the family key f chip programming and escrow all clipper chips are programmed inside a scif secure computer information facility which is essentially a vault the scif contains a laptop computer and equipment to program the chips about chips are programmed during a single session the scif is located at mikotronx at the beginning of a session a trusted agent from each of the two key escrow agencies enters the vault agent enters an bit value s into the laptop and agent enters an bit value s these values serve as seeds to generate keys for a sequence of serial numbers to generate the unit key for a serial number n the bit value n is first padded with a fixed bit block to produce a bit block n s and s are then used as keys to triple encrypt n producing a bit block r r e d e n s s s similarly n is padded with two other bit blocks to produce n and n and two additional bit blocks r and r are computed r e d e n s s s r e d e n s s s r r and r are then concatenated together giving bits the first bits are assigned to u and the second bits to u the rest are discarded the unit key u is the xor of u and u u and u are the key parts that are separately escrowed with the two escrow agencies as a sequence of values for u u and u are generated they are written onto three separate floppy disks the first disk contains a file for each serial number that contains the corresponding key part u the second disk is similar but contains the u values the third disk contains the unit keys u agent takes the first disk and agent takes the second disk the third disk is used to program the chips after the chips are programmed all information is discarded from the vault and the agents leave the laptop may be destroyed for additional assurance that no information is left behind the protocol may be changed slightly so that four people are in the room instead of two the first two would provide the seeds s and s and the second two the escrow agents would take the disks back to the escrow agencies the escrow agencies have as yet to be determined but they will not be the nsa cia fbi or any other law enforcement agency one or both may be independent from the government law enforcement use when law enforcement has been authorized to tap an encrypted line they will first take the warrant to the service provider in order to get access to the communications line let us assume that the tap is in place and that they have determined that the line is encrypted with clipper they will first decrypt the law enforcement block with the family key f this gives them e k u n they will then take a warrant identifying the chip serial number n to each of the key escrow agents and get back u and u u and u are xored together to produce the unit key u and e k u is decrypted to get the session key k finally the message stream is decrypted all this will be accomplished through a special black box decoder operated by the fbi acknowledgment and distribution notice all information is based on information provided by nsa nist and the fbi permission to distribute this document is granted
