Hellman's Hints

I presume that Hellman meant to say 
            "K1 and K2, and thence UK"
in place of "K1 and K2, and thence K" at least it makes sense that way.
A later posting from Hellman (I think) emmended the description
of the transmitted message from
    E{ E[M; K], E[K; UK], serial number; SK}
to  E[M; K], E{ E[K; UK], serial number; SK}
 
If you know SK then you can compute (E[K; UK], serial number)
Then knowing UK (= K1+K2) you can compute K
from which you get M via E[M; K].

Please excuse some questions from a somewhat crypto-naive person, but
I'd like to try to understand this thing a little better so I don't make
any stupid goofs if I talk about it.

I presume that we can simply consider this 'universal' key as if it
didn't exist?  Well, actually, I suppose it prevents 'joe average' from
getting the serial number, but certainly not foreign agents or any
criminal who has motivation to get it(*).  After all, a secret known by
more than one person will not remain a secret long, and this one is
going to be known by thousands.  Why even bother with it?  It seems like
it just adds compute overhead that could be better used for other
things.

(* I assume the TLAs get it legally)

The fact that the serial number is effectively in the clear then means
that traffic analysis attacks can glean information for anyone who can
get at the phone lines, yes?  Even if the states were to outlaw caller
id, these tapper phones would reintroduce that level of traceability.
Even worse, in some ways, since your tapper 'identity' goes with you if
you change phone numbers as long as you keep your old phone.

Finally, can anyone explain to me how this thing /works/, at the simple
'this is what you do with this key' level of description of how RSA
works?  I can't figure out how two phones can communicate with each
other without compromising one key or another, since RSA does /not/ seem
to be involved in this (there is no public key registry, right?)
Sorry if this is a dumb question . . . 

-- 
david			david@staff.udc.upenn.edu

It occurred to me that the "clipper chip" makes it easier for the
government to tap voice telephone trunks & do traffic analysis.
Current long-haul phone technology uses out-of-band signalling on
different, reportedly encrypted, trunks, so to make any sense out of
the data trunks you also have to listen in on the signalling trunks
and correllate what you record there with what you record off the data
trunks.

With the wiretap chip in place, all they need to do is to "surf" the
data trunks looking for the encrypted serial number of the devices
they're interested in.

Depending on what the encryption tag blocks *really* look like, you
might not even need SK in order to do traffic analysis.  Even if the
tag blocks are built with confounders and similar randomness included
to discourage ciphertext matching, the SK can be found in *every
single chip* and it's only a matter of time before someone gets it,
either by electron microscope or by bribing some of the hundreds of
people likely to have access to the key.

				- Bill