more technical details here are some corrections and additions to hellman s note courtesy of dorothy denning again this is reposted with permission two requests first note the roles of s and s it appears to me and others that anyone who knows those values can construct the unit key and the nature of the generation process for k and k is such that neither can be produced alone thus the scheme cannot be implemented such that one repository generates the first half key and another generates the second that is ominous second these postings are not revealed scripture nor are they carefully crafted spook postings don t attempt to draw out hidden meanings as opposed to say the official announcements of clipper leave denning out of this given hellman s record of opposition to des which goes back before some folks on this newsgroup knew how to read i don t think you can impugn his integrity oh yeah the folks who invented clipper aren t stupid if you think something doesn t make sense it s almost certainly because you don t understand their goals steve bellovin date sun apr edt from denning cs georgetown edu dorothy denning subject re clipper chip to a long list of folks i was also briefed by the nsa and fbi so let me add a few comments to marty s message the clipper chip will have a secret crypto algorithm embedded in the algorithm operates on bit blocks like des and the chip supports all des modes of operation the algorithm uses rounds of scrambling compared with in des in addition to the system key each user will get to choose his or her own key and change it as often as desired call this key plain old k when a message is to be sent it will first be k is the session key shared by the sender and receiver any method e g public key can be used to establish the session key in the at t telephone security devices which will have the new chip the key is negotiated using a public key protocol encrypted under k then k will be encrypted under the unit key uk and the serial number of the unit added to produce a three part message which will then be encrypted under the system key sk producing e e m k e k uk serial number sk my understanding is that e m k is not encrypted under sk called the family key and that the decrypt key corresponding to sk is held by law enforcement does anyone have first hand knowledge on this i will also check it out but this is am sunday so i did not want to wait the unit key will be generated as the xor of two bit random numbers k and k uk k k which will be kept by the two escrow the unit key also called the chip key is generated from the serial number n as follows let n n and n be bit blocks derived from n and let s and s be two bit seeds used as keys compute the bit block r e d e n s s s note that this is like using the des in triple encryption mode with two keys similarly compute blocks r and r starting with n and n i m unlear about whether the keys s and s change the fact that they re called seeds suggests they might then r r and r are concatenated together giving bits the first bits form k and the next bits form k the remaining bits are discarded authorities who these escrow authorities will be is still to be decided by the attorney general but it was stressed to me that they will not be nsa or law enforcement agencies that they must be parties acceptable to the users of the system as unbiased marty is right on this and the fbi has asked me for suggestions please pass them to me along with your reasons in addition to marty s criteria i would add that the agencies must have an established record of being able to safeguard highly sensitive information some suggestions i ve received so far include sri rand mitre the national labs sandia lanl los alamos treasury gao when a court order obtains k and k and thence k the law enforcement agency will use sk to decrypt all information flowing on the suspected link aside it is my guess that they may do this constantly on all links with or without a court order since it is almost impossible to tell which links over which a message will flow my understanding is that there will be only one decode box and that it will be operated by the fbi the service provider will isolate the communications stream and pass it to the fbi where it will pass through the decode box which will have been keyed with k for the wiretap authorizations when levy asked for the details so he could review the cases as required by law the agent told him that his predecessors just turned over blank signed forms every time levi did not comply and changed the system but the lesson is clear no single person or authority should have the power to authorize wiretaps no single person does at least for fbi taps after completing a mound of paperwork an agent must get the approval of several people on a chain that includes fbi legal counsel before the request is even taken to the attorney general for final approval dorothy denning
