Re: Ames/clipper compromised?

Thanks much for posting.  I have a lot of trouble with much of the
article, though, on purely technical grounds.  Consider the following
passage:

	 The  words I also heard were, "If there's only even a  1%  chance 
	 that  Clipper has been compromised, the whole thing's  over.   We 
	 have to start from scratch."

What does it mean to ``compromise'' Clipper?  The algorithm is known?
No big deal, in my opinion -- Skipjack was almost certainly designed to
be strong even if the algorithm was known.  (As I've said before, I tend
to believe NSA on that point.  I suspect they're telling us the truth
about Clipper -- just not the whole truth -- and what they've said is
damning enough even if 100% accurate.)  It's also quite unlikely that
Ames would ever have seen the algorithm; it's just not something he'd
have any reason to know.

Might he have stolen the family key?  More plausible, though again it's
not something that would be left lying around, as opposed to being
embedded in equipment.  Could he have turned over a magic decoder box,
which would have to know that key?  Not at all unreasonable -- and the
decoder boxes are at a sufficiently early stage of design that they
may not yet be armored against tampering.  But from everything that's
been published, very few Clipper chips have been deployed so far.  It
would not be a major project to recall and rekey the devices.

Copies of the key escrow databases?  Same argument applies -- though if
that's what was stolen, we have to ask how he had access to ``both'' of
them.  I don't believe there have ever been any categorical statements
about how FISA access to Clipper conversations would be obtained.  See
above under ``whole truth''...

It may be, of course, that the episode has made the powers that be wonder
about the wisdom of keeping any such keys around.  There's been a very 
strong trend in recent years to avoid *any* sort of cryptography where
session keys live anywhere but inside sealed boxes, precisely to avoid
key theft.  (See Diffie's retrospective on public key technology for
more detailed discussion and some examples.)  And it's also why the
government doesn't want to use Clipper -- as opposed to Skipjack -- for
classified information.  

So -- if the story is true, just what did Ames steal that would require
them to ``start over from scratch''?  Is there another back door?  That's
the only thing I can think of that would require such an action -- which
means that if they do hold off, there's a new topic to explore via FOIA
requests and the like.

		--Steve Bellovin

The  words I also heard were, "If there's only even a  1%  chance 
	 that  Clipper has been compromised, the whole thing's  over.   We 
	 have to start from scratch."
   What does it mean to ``compromise'' Clipper?  The algorithm is known?

Yeah.. this doesn't completely add up unless (a) the source is lying
or (b) there's a "blatant" back door.

If the algorithm becomes known at this stage in the game, they can
probably "easily" generate a modified SKIPJACK algorithm (changing the
S-boxes or equivalent), a new family key, and a subtle variation on
key generation.  They might not even need to re-spin the chip design
if, as they claimed, the critical parts of the algorithm are
programmed into the chip after fabrication.

BTW, my guess at the most likely back door is that the unit keys will
be generated as a cryptographic function of the serial number and a
*small* random number generated for each chip and unknown to the
agency.  They would have to search a mere 2**16..2**32 keys once they
get the serial number out of the LEEF.  The existance of such a
backdoor would be difficult to prove, since there would be no visible
evidence for it in the individual chips.  It is also difficult to
disprove such a theory because the clipper key generation algorithms
are classified.

					- Bill