re off the shelf cheap des keyseach machine was re corporate acceptance of the wiretap chip in article c sy z td demon co uk graham toal gtoal gtoal com writes in article apr ulysses att com smb research att com steven bellovin writes thousands tens of thousands do some arithmetic please skipjack has possible keys we don t yet know if all bits count that doesn t worry me at all they re not going to cheat at something they can get caught at and key size is one of the things that can be verified externally feed lots of random key input pairs into the chip then try flipping random key bits and see what happens to the output we already know what should happen about half the output bits should vary on average from a bit key change or input change if they were out to build a weak cryptosystem it might be the case that some of the bits are much less powerful than others in the sense that they only enter into the encryption very late in the game by contrast des was designed to use each key bit as early as possible the output change rate appears as early as round again though i don t think nsa is going to cheat that crudely they re likely to get caught remember that they ve promised to let a committee of outside experts see the cryptosystem design if you assume something des like a biased subkey generation schedule will stick out like a sore thumb the committee can and should run lots of tests and retain the output this can be verified later against the chip and yes the civilian community has at least some secure storage facilities that i don t think even nsa can get into without it being noticed until fort meade gets its transporter working again oops i don t think i was supposed to talk about that the committee members can even retain secure copies of the code in two halves which you have to xor together to recover the program seriously there are i think problems with this whole scheme but the people who invented it aren t stupid and they ve been in the crypto game and the smoke and mirrors game far longer than most of us they re not going to lie in ways that can be detected easily since their credibility is the only thing they can use to sell this system if they ve lied about the civilian committee no one will believe them about the absence of other back doors if they ve lied about the key size no one will believe that they haven t copied the programming disk with the u keys if they ve lied about obvious aspects of the strength of the cryptosystem no one will believe the escrow agencies aren t in cahoots with them that isn t to say that they aren t lying about all those other things anyway and i m certainly not claiming that nsa can t build a cryptosystem with a back door that the committee can t find look how long it took for folks to believe that the s boxes weren t sabotaged it s entirely possible that the committee will release an ambiguous report for just such reasons but that s a subtle point i e one you can t explain to a senator anyway its looking like the keys and escrow arrangements are smoke and mirrors to cover the way the nsa can regenerate the key from the transmitted serial number i don t like the unit key generation process any better than you do however s and s are supposed to be under control of the same escrow agents if they can t be trusted to keep the seed values secure they can t be trusted to keep the half keys secure i still don t know if or when s and s change i thought i had seen something about them being constant but i just reread denning s technical information post and it doesn t say anything one way or the other steve bellovin
