re would clipper make a good cover for other encryption method in article apr eff org kadie eff org carl m kadie writes clipper might be a good way to cover the use of another layer of encryption but if you are making custom equipment in any case why not just roll your own clipper implementation and report the wrong keys to the escrow agency tells us who is going to be in the chip business if this thing goes through nsa and those with something to hide from nsa if anyone can verify that your phone is not using the key registered to that serial number either they have a court ordered wiretap but what are they going to do tell the judge that this individual really does have privacy all they know is that the keys are not enough but not why they have a court ordered wiretap on a phone in this series this part is really scary since the expectation is that all chips in a particular batch will uses seeds based on the same s and s and the serial number getting the keys for one of a batch may give access to all there is a backdoor which allows all messages to be deciphered without the keys i find this one especially threatening since the scheme seems very open to known plaintext attacks what i need to decipher is the data in the header if i talk to someone who has one of these phones presumably there will be an automatically negotiated key generated i m not trying to decipher the record of the conversation to know what was said i use it as a known plaintext to recover the backdoor represented by the header but i know what the header says for conversations i participate in even worse if the phones in a series have related keys i can buy a phone chip from the same production lot then i can recover its keys either elegantly by talking to myself or by brute force analysis of the actual chip then apply the key generation process with those seeds to find the target keys hmmm i don t think i want to ever come close to these phones even des is starting to look good two cans and a string will provide much better security robert i eachus with standard disclaimer use standard disclaimer function message text in clever ideas return better ideas is
