- cypherpunks-legacy - lists.cpunks.org

Denning Unmasked
by L. Detweiler 20 Apr '93

20 Apr '93

Denning, April 19 >I'd like to add that I was not in >any way involved. I found out about it when the FBI briefed me on >Thursday evening, April 15. Mr. May calls Mrs. Denning's claims that she was ``not in any way involved'' with this project ``curious''. I'm a bit amazed at everyone's tiptoeing around Mrs. Denning and reluctance to challenge her outright given overwhelming evidence as to her two-facedness. Maybe it is her established reputation in the field, maybe it is her cryptography book, maybe it is her participation at conferences like CFP. Nevertheless, I cannot let lies stand. Mrs. Denning wants to have her cake and eat it too. She wants to be perceived as an unbiased academic and taken seriously for her participation in scientific forums. She also wants to mask her involvement in this proposal, which for me, appears unequivocal, and only the *degree* and *extent* is unclear. I cannot comprehend how she cannot be involved. It would not be so outrageous if she stated that ``I cannot comment on my involvement for obvious reasons''. But her denial to me has all the signs of a desperate fabrication. Lets look at what she's done: 1. She was the *first*, if I'm not mistaken, to bring up the idea of splitting keys among impartial agencies many months ago on sci.crypt after the firestorm and barrage of protests on the initial balloon on key registration. 2. She has shown ``prescient insight'' (as another tiptoer noted on sci.crypt) into anticipating major aspects of the proposal. Key registration itself was largely unheard-of until she began advocating the idea. She posts a massive technical description to sci.crypt less than a week after her initial ``briefing''. 3. The rhetoric (more aptly called propaganda) of the public announcement closely mirrors words and arguments she used in the initial debate on sci.crypt, esp. the ``need to balance legitimate law enforcement goals with privacy.'' 4. Since she persists in her sheer, ugly chutzpuh, and people here and on sci.crypt are still pussyfooting around her, I must offer my new evidence. In early April I became extremely concerned about her continuing advocation of key registration in the recent further CACM articles in the face of such vocal opposition and defiance on sci.crypt. I was astonished with the claims in her latest posting to sci.crypt when I read it on 28 March, and replied to it. I expressed my appreciation for her postings, because ``you're definitely one of the most highly regard personalities in this area posting publicly,'' (I was disenchanted enough then not to say `authority') and I wrote of my extreme concern with her seeming evasion of addressing critical aspects of the key-registration idea from a scientific standpoint. I advised her to ``abandon the idea to salvage the remainder of your reputation''. I will be quoting only some critical parts of her letter now (there is only one, but it speaks volumes), and I ask that I not be assaulted for this, because in my opinion the extreme circumstances merit it, and her hypocrisies cannot go unchallenged! Her comments follow her pattern of revealing a few more details of the overall plan after being violently assaulted on the revealed ones. (I remind the reader that this all transpired before any knowledge on my part whatsoever of the Clipper proposal, but apparently not before her own...) - - - L.D.: (Sun, 28 Mar 93 22:13:06 -0700) >The issue is not that "the government is corrupt QED" but that such a >system would be such a tremendous temptation to a government only bordering >on moral rectitude, as ours generally is... Part of the idea of >democracy is not even INTRODUCING mechanisms that have a potential for >extremely insideous and treacherous abuse. D.D.: (Tue, 30 Mar 93 17:23:14 EST) >I am convinced that with the new technologies and crypto, we can make it >extremely difficult -- much more difficult than now -- for the government >to perform illegal taps. L.D.: (Sun, 28 Mar 93 22:13:06 -0700) >I like those new technologies for the same revolutionary reasons. >hehe, we can make it IMPOSSIBLE right now for the government to tap AT >ALL. I guess you can imagine how appealing your proposal is in the face >of this. We're doing just fine, thank you very much. The best thing >the government can do on this issue is STAY OUT OF IT. Given it's >unweildy and intrusive history, this is quite an optimistic expectation. - - - L.D.: (Sun, 28 Mar 93 22:13:06 -0700) >There are just no good assurances that these kind of systems won't >be radically abused, and until you describe precisely how to do this >most reasonable people will not touch your proposals with a 20ft >pole, even in cyberspace... D.D.: (Tue, 30 Mar 93 17:23:14 EST) >Obviously a much more detailed proposal would be needed in >order to answer all the questions people have asked. L.D.: (Tue, 30 Mar 93 17:03:04 -0700) >We eagerly await such a proposal from you or others, to show how none >of the specifics can possibly be implemented without a totalitarian >state, bizarre and unrealistic assumptions, unbearable and >anti-competitive commercial restrictions, or new grotesque government >bureacracies. - - - L.D.: (Sun, 28 Mar 93 22:13:06 -0700) >The issue is not that "criminals won't comply QED" >but that "enforcement is impossible except in a totalitarian state". D.D.: (Tue, 30 Mar 93 17:23:14 EST) >Not necessarily if you don't try to demand 100% compliance. Everyone is >required to register their car, and this has not required a totalitarian state. >Compliance might be enforced only when there is already probably cause and >a warrant issued. Compliance might be promoted by putting requirements on >products that are sold. L.D.: (Tue, 30 Mar 93 17:03:04 -0700) >I object to this vehemently. I consider this somewhat of a subterfuge. >The public then may not be aware how much they are spending to promote >an agenda of the anointed government officials' plans detrimental to >privacy. It would weaken technological competiveness, for companies to >be burdened by these artificial and warped restrictions. > >Unfortunately, I find it one of your most dangerously insidious ideas, >because it has the most likelihood of influencing some naive, >uninformed, and misguided policymaker... > >These policies you have in mind are exactly the kind that sound good on >paper and intent, but when implemented come nothing close to the >intentions of the purveyors, who on hint of failure would then >disassociate themselves, saying that ``it wasn't implemented according >to my suggestions.'' That's the problem, its an inherently flawed idea >to begin with, and NO implementation would have the desired effect... - - - D.D.: (Tue, 30 Mar 93 17:23:14 EST) >I do not find >sci.crypt a constructive environment to explore the issues or try to develop >a more concrete proposal, so I will use other forums for this. L.D.: (Tue, 30 Mar 93 17:03:04 -0700) >definitely, Usenet has all the delicacy, subtlety and finesse of a >melee. On the other hand, it also has a low tolerance for pretentious >and impractical ideas ... > >I'm serious. I think you ought to stop promoting the idea. Otherwise, >the label "Denning Proposal" will have all the valiant credibility that >the label "Chamberlain Treaty" had after WWII.... Don't say I didn't warn >you! > >Do you know how much trouble the NSA has caused for the development and >proliferation of cryptography? Do you think they have harmed American >interests in the international market? Weakened their ability to >compete? I guarantee that all this would PALE TOTALLY in comparison to >any kind of key-registration scheme, and would earn its advocates, in >historical hindsight, the utmost black discredit imaginable. - - - Mrs. Denning did not respond to my letter of Tue, 30 Mar 93 17:03:04 -0700, for obvious reasons... Let me add that of all the things she wrote about, the `commercial compliance by requirements on products sold' alarmed me the most, and I thought she might be hinting at Telephony-style bill. I considered sending a warning to the cypherpunk list, but decided that it would be premature and I intended to watch and wait for more signs first... Perhaps I am condemning aspects of my own future in academic circles for attacking Denning. Perhaps I am the subject of zealous blacklisting at this moment for my public comments on the Clipper chip. But I cannot be silent in the face of repulsive and outrageous hypocrisy. Because of her denial, I have no alternative but to recognize Mrs. Denning as the intellectual and moral equivalent of a double-agent. She is a traitor to at least *one* cause. I hope her friends involved in the Clipper proposal appreciate her work in that area, because, for me, she no longer has any credibility whatsoever as an unbiased cryptographic authority or an honest and ethical scientist. Like a compromised code, the integrity has been lost... NOTE! this letter is a *warning* for the private cypherpunks list only! I do not grant, and specifically prohibit, redistribution. If Mrs. Denning publicly addresses the points I have raised in this letter, I will consider my sincere trust misguided and violated.

1 0

Re: WIRETAP: Non-technical statement
by szabo＠techbook.com 20 Apr '93

20 Apr '93

> [proposed press statement] > .... > This has come to be known as the > Wiretap chip since it allows any Law Enforcement agency to automatically > decrypt any conversations made with it with a search warrant. > ... I understand there are some situations where law enforcement agencies can gain access to keys _without_ a search warrant, and furthermore access to the keys allows wiretapping of conversations that go well beyond the scope of the search warrant. This might be better phrased "with, or in many cases even without, a search warrant". Does anybody know of specific examples of wiretapping without a search warrant, or beyond the scope of the search warrant that we can cite? Especially famous ones (didn't Nixon wiretap somebody?) Question: does there need to be a warrant to search *both* parties in a conversation, or just one? What if one of the parties is a foreign citizen calling from their homeland? What about conference calls? In addition to lawyer-client and doctor-patient conversations, ubiquity of the wiretap chip allows the U.S. government exclusive access to recording the following calls under the rubric of a "secure" system: * husband-wife * psychologist-client * priest-confessor * foreign tourists, businessmen, and diplomats * international phone calls * phone calls outside the U.S. involving Clipper phones (last I heard AT&T was planning to export the wiretap chip phone, can that be verified?) * etc. We might design a special press release to be sent to the *international* press and foreign companies. We might especially target electronics giants like Matsushita, Phillips, Siemens, Fujitsu, NEC, etc. that can make alternative chips if they feel there is market demand for privacy from U.S. spooks who speak of using the wiretap chip to "enhance U.S. economic competitiveness". This might be a joint venture with U.S. companies like Security Technologies Inc. that AT&T and the U.S. government have screwed with their collusion. The vast majority of consumer-product chips are manufactured outside the U.S. It is doubtful that VLSI can compete, much less corner the market if international concern is raised over the potential U.S. wiretapping monopoly. However, we do need to do this in such a way that we do not encourage foreign government escrow-key schemes. Let's use the term "wiretap chip" for the entire class of escrow-key hardware schemes. I think we have a shot at giving the entire class of Denning-style schemes a bad reputation in the international community. One desirable foreign government action would be to ban the import of phone equipment containing escrow-key chips from the U.S.; a very undesirable outcome is for foreign governments to set up their own escrow-key systems. Primarily, we want to give wiretap chips a bad reputation in the market. We also need to dig up information on the phone call archives being kept by the NSA and other agencies. How extensive are they? Is there any guarantee phone calls will be deleted after some period, or are phone calls once tapped stored forever on some CD-ROM? Can foreign companies operating in the U.S. have any confidence that the U.S. government is not wiretapping their phones, gleaning trade secrets and distributing them to favored U.S. megacorps like AT&T? If we don't have answers to these questions we need to ask them, in public and often. Nick Szabo szabo(a)techbook.com

1 0

Re: Another Clipper weakness
by Hal 20 Apr '93

20 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- From: "Perry E. Metzger" <pmetzger(a)lehman.com> > I've just looked over the proposal again, and I've seen no mention of > random inputs -- only that the 30 bit key would get a "fixed 34 bit > padding" added to it. Here is what Denning's writeup says: At the beginning of a session, a trusted agent from each of the two key escrow agencies enters the vault. Agent 1 enters an 80-bit value S1 into the laptop and agent 2 enters an 80-bit value S2. These values serve as seeds to generate keys for a sequence of serial numbers. To generate the unit key for a serial number N, the 30-bit value N is first padded with a fixed 34-bit block to produce a 64-bit block N1. S1 and S2 are then used as keys to triple-encrypt N1, producing a 64-bit block R1: R1 = E[D[E[N1; S1]; S2]; S1] . Similarly, N is padded with two other 34-bit blocks to produce N2 and N3, and two additional 64-bit blocks R2 and R3 are computed: R2 = E[D[E[N2; S1]; S2]; S1] R3 = E[D[E[N3; S1]; S2]; S1] . R1, R2, and R3 are then concatenated together, giving 192 bits. The first 80 bits are assigned to U1 and the second 80 bits to U2. The rest are discarded. The unit key U is the XOR of U1 and U2. U1 and U2 are the key parts that are separately escrowed with the two escrow agencies. Here, the notiation E[X; Y] means to encrypt 64-bit number X using 80-bit key Y with the Skipjack algorithm. U1 and U2 come from concatenating R1, R2, and R3. Each of R1, R2, and R3 is a function not only of N, the serial number, along with the 3 fixed 34-bit blocks, but also S1 and S2, the two random numbers entered by agents from the escrow organizations. > > The one problem is that S1 and S2 are not changed for each chip, but are > > rather kept the same in programming a batch of about 300 chips. Then > > they are supposed to be destroyed. > > This was not clearly implied, either. Furthermore, no clear reason has > been stated why all this complexity is needed and U1 and U2 can't just > be randomly generated. All Clipper Chips are programmed inside a SCIF (secure computer information facility), which is essentially a vault. The SCIF contains a laptop computer and equipment to program the chips. About 300 chips are programmed during a single session. The SCIF is located at Mikotronx. I agree that the process seems complex. Why should the keys U1 and U2 be correlated with the serial number in this way? Here is one thought: The most straightforward approach would be to get two random seeds, S1 and S2, and use them to run a PRNG that produces U1 and U2, the two key-halves, and N, the serial number. But the problem with this is that you are depending on the security of your PRNG to ensure that there is no correlation between N and U1/U2. Ordinary PRNG's might allow some correlation to exist. This would be weak because then just knowing the N of your chip might allow a good organization like NSA to crunch out U1 and U2 without going through the escrow agencies, by exploiting weaknesses in the PRNG. Instead, they go through a roundabout process which appears to show that the relationship between N and U1/U2 is as strong as the Skipjack algorithm itself, in fact when run in a triple-encryption mode. If NSA had a way, given N, to produce U1/U2, then it would appear that they must be able to break Skipjack, in which case they wouldn't need U1/U2. So this key generation process can be argued not to introduce any new vulnerability in the system. Hal -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK9QrV6gTA69YIUw3AQGGrAP/Rmx0H603b1EdBIsiGuc637wptW133IFU /irxw+aCPrL3yOzuBTQbUW+LeMIwpC+Y8DARkAohxnIjhuu/aQXVnIvJPPiUSPr0 fz2PLxhA5tgjVAH0e5xvl9K+CgWnRXazd9Tp+Zbi/xAiWz0PI6kff4QtNG13p1xw /V0dGDb4tec= =XgfH -----END PGP SIGNATURE-----

2 1

cypherpunks vs. cryptoprivacy
by TO1SITTLER＠APSICC.APS.EDU 20 Apr '93

20 Apr '93

I agree with those who think that "CypherPunks" is a bad name for the list. It brings up negative associations in the minds of outsiders, who are, after all, the people who we want to influence against the Big Brother wiretap chip. Kragen

1 0

Waco, crypto, and unbreakable links
by grady＠netcom.com 20 Apr '93

20 Apr '93

We can only speculate that the loss of life might have been much fewer if the Branch Davidian cult had a copy of PGP as well as a 2m packet radio. They could have maintained private links with journalists who could have given us their side of the story, which now, tragically will never be told.

2 1

Re: Wiretapping chip: vid clips & sound bites
by wcs＠anchor.ho.att.com 20 Apr '93

20 Apr '93

I strongly agree with Ray Cromwell's suggestions that we consistently refer to "the wiretap chip", and avoid "drug dealer" examples. One that might be closer to home when you need an example is "Suppose the IRS thinks you may have cheated on your income tax and decides they want to wiretap your phone ..." It's within the range of things people imagine could happen to them, and it makes the point that it's *their* phone that's being trapped, not some public enemy bogeyman. Making it personal is important... Bill # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

Re: Sound bite time
by peb＠PROCASE.COM 20 Apr '93

20 Apr '93

I like the newer sound bites. ``Having to deposit copies of all your private letters with the authorities, "in case" they need to later read them...'' and ``Giving the government keys to your encrypted messages is like giving them keys to the front door of your house.'' seem best. Phil, About the right to bear arms and crypto-privacy...you are right--it is not a good sound bite for J. Q. Public, but could be a good angle for *understanding* (uhg, I hate this sound bite stuff.) Paul E. Baclace peb(a)procase.com

1 0

WIRETAP: Non-technical statement
by dstalder＠gmuvax2.gmu.edu 20 Apr '93

20 Apr '93

I've had some people ask me about a non-technical synopsis of the Wiretap Chip proposal. What follows is it. Can you please look over it for errors? I am still very much the amateur when it comes to cryptography. The WIRE-TAP Proposal: Problems with it. The White House sent out a press release on Friday 16 April about a voice encryption chip called the Clipper chip. This has come to be known as the Wiretap chip since it allows any Law Enforcement agency to automatically decrypt any conversations made with it with a search warrant. The LE presents said search warrant to two different escrow agencies to obtain the keys (80 bits long) that automatically decrypts your conversation. The Electronic Freedom Foundation (EFF) and the Computer Professionals for Social Responsibility (CPSR) have both criticized the proposal. There was even a negative article already in Network World (19 Apr 93). The paragraphs that follow are facts and problems I have collected by listening to other discuss the Wiretap chip. Say you wanted to encrypt your talk with someone over a phone. Well, since you and the person you want to talk to both have the Wiretap (Clipper) chip in your phones, you can automatically encrypt your conversation. All fine and good encryption for the consumer. Now, what if you come under investigation by the local constabulary? The get a court order and ask the escrow agencies (non-law enforcement types) for your key. They already have the family key since that is the same in each chip. They now have your specific key. With these two keys, they can decrypt all conversations that you have. This includes conversations that are not legal to wiretap such as attorney-client, doctor-patient and so on. They also have that key for any all future sessions that you use that phone for. Start to see the problem? This part is all legal... Search warrants are even exceedingly easy to get at times. There have been reports of the FBI get groups of 50 signed and blank search warrants from the DoJ. Now, there are other problems. Would you give the IRS keys to your house and filing cabinet as long as they promised that they would only use it under proper authorization? The key length of 80 bits is still considered cryptographically weak. It would take determined effort by an agency with a supercomputer but your key could be broken. The cryptographic algorithm is also being kept classified. This is not the usual practice. In the cryptographic community, algorithms are public. This way people can be assured there aren't any back doors and that the algorithm can stand on its own strengths, not that of secrecy. It has also been hinted at by NIST (the agency behind the technical implementation of the chip.) that the chip could be compromised if the algorithm was made public. It is not that difficult to reverse engineer a chip these days. Finally, some of the implications behind this announcements are dire. The Wiretap chip could become the market or legislative standard. This could mean that other implementations of cryptographic voice transactions would be very difficult to obtain or would be illegal to obtain. Why would a criminal use the Wiretap chip when they knew it wouldn't encrypt their conversations against the LE agencies? They wouldn't, they would use other encryption technologies. Would this mean that using something other than the Wiretap chip is probable cause and puts you under suspicion? One last fishy thing is that AT&T has already (on the same day) announced phones with this chip. This implies (means?) that AT&T has known about this chip for a while. They seem to be more concerned about getting a jump on the competition than producing a product that will actually give their users real security. 'Course, there is the question of collusion between the governement and industry. Only two companies will be allowed to manufacture the chip, VLSI and Mykotronix. Jeff Hendy, director of new product marketing for VLSI, says his company expects to make $50 million of the chip in the next 3 years. (This from the San Jose Mercury News.) Hopefully, I haven't left stuff out. I am going to forward this to cypherpunks for the experts there to check it out. Think free, -- Defeat the Torin/Darren Stalder/Wolf __ Wiretap Chip Internet: dstalder(a)gmuvax2.gmu.edu \/ PGP2.x key available. Proposal! Bitnet: dstalder@gmuvax Finger me. Write me for Sprintnet: 1-703-845-1000 details. Snail: 10310 Main St., Suite 110/Fairfax, VA/22030/USA DISCLAIMER: A society where such disclaimers are needed is saddening.

1 0

Another Clipper weakness
by Hal 20 Apr '93

20 Apr '93

Perry asks about the 30-bit serial number. Actually, it appears that the unit key UK is a function of the serial number plus the two 80-bit random numbers input by the escrow agents when the chips are programmed. This would prevent an easy guessing attack as long as these random numbers S1 and S2 are unknown. The one problem is that S1 and S2 are not changed for each chip, but are rather kept the same in programming a batch of about 300 chips. Then they are supposed to be destroyed. The potential weakness is that if someone managed to keep a copy of the S1 and S2 values which were used to program all clipper chips (only about 3000 such values for a million chips), then Perry's suggested attack could work. This would be few enough bits that the unit key could be guessed. Those who are asked to judge the safety of the system will presumably pay careful attention to the measures used to insure that S1 and S2 are not saved. I don't know how they'll check for NSA micro-cameras in the vault ceiling, though... Hal

1 0

(fwd) THE CLIPPER CHIP: A TECHNICAL SUMMARY
by tcmay＠netcom.com 20 Apr '93

20 Apr '93

Cypherpunks, Here's the most complete and readable summary of the Wiretap Chip I've seen. Ironically, it comes from none other than Dorothy, the Wicked Witch of the East, who claims she knew nothing of it until Thursday night, just before the announcement. Curiouser and curiouser. -Tim May From: denning(a)guvax.acc.georgetown.edu Newsgroups: sci.crypt Subject: THE CLIPPER CHIP: A TECHNICAL SUMMARY Date: 19 Apr 93 18:23:27 -0400 Distribution: world Organization: Georgetown University The following document summarizes the Clipper Chip, how it is used, how programming of the chip is coupled to key generation and the escrow process, and how law enforcement decrypts communications. Since there has been some speculation on this news group about my own involvement in this project, I'd like to add that I was not in any way involved. I found out about it when the FBI briefed me on Thursday evening, April 15. Since then I have spent considerable time talking with the NSA and FBI to learn more about this, and I attended the NIST briefing at the Department of Commerce on April 16. The document below is the result of that effort. Dorothy Denning --------------- THE CLIPPER CHIP: A TECHNICAL SUMMARY Dorothy Denning April 19, 1993 INTRODUCTION On April 16, the President announced a new initiative that will bring together the Federal Government and industry in a voluntary program to provide secure communications while meeting the legitimate needs of law enforcement. At the heart of the plan is a new tamper-proof encryption chip called the "Clipper Chip" together with a split-key approach to escrowing keys. Two escrow agencies are used, and the key parts from both are needed to reconstruct a key. CHIP STRUCTURE The Clipper Chip contains a classified 64-bit block encryption algorithm called "Skipjack." The algorithm uses 80 bit keys (compared with 56 for the DES) and has 32 rounds of scrambling (compared with 16 for the DES). It supports all 4 DES modes of operation. Throughput is 16 Mbits a second. Each chip includes the following components: the Skipjack encryption algorithm F, an 80-bit family key that is common to all chips N, a 30-bit serial number U, an 80-bit secret key that unlocks all messages encrypted with the chip ENCRYPTING WITH THE CHIP To see how the chip is used, imagine that it is embedded in the AT&T telephone security device (as it will be). Suppose I call someone and we both have such a device. After pushing a button to start a secure conversation, my security device will negotiate a session key K with the device at the other end (in general, any method of key exchange can be used). The key K and message stream M (i.e., digitized voice) are then fed into the Clipper Chip to produce two values: E[M; K], the encrypted message stream, and E[E[K; U] + N; F], a law enforcement block. The law enforcement block thus contains the session key K encrypted under the unit key U concatenated with the serial number N, all encrypted under the family key F. CHIP PROGRAMMING AND ESCROW All Clipper Chips are programmed inside a SCIF (secure computer information facility), which is essentially a vault. The SCIF contains a laptop computer and equipment to program the chips. About 300 chips are programmed during a single session. The SCIF is located at Mikotronx. At the beginning of a session, a trusted agent from each of the two key escrow agencies enters the vault. Agent 1 enters an 80-bit value S1 into the laptop and agent 2 enters an 80-bit value S2. These values serve as seeds to generate keys for a sequence of serial numbers. To generate the unit key for a serial number N, the 30-bit value N is first padded with a fixed 34-bit block to produce a 64-bit block N1. S1 and S2 are then used as keys to triple-encrypt N1, producing a 64-bit block R1: R1 = E[D[E[N1; S1]; S2]; S1] . Similarly, N is padded with two other 34-bit blocks to produce N2 and N3, and two additional 64-bit blocks R2 and R3 are computed: R2 = E[D[E[N2; S1]; S2]; S1] R3 = E[D[E[N3; S1]; S2]; S1] . R1, R2, and R3 are then concatenated together, giving 192 bits. The first 80 bits are assigned to U1 and the second 80 bits to U2. The rest are discarded. The unit key U is the XOR of U1 and U2. U1 and U2 are the key parts that are separately escrowed with the two escrow agencies. As a sequence of values for U1, U2, and U are generated, they are written onto three separate floppy disks. The first disk contains a file for each serial number that contains the corresponding key part U1. The second disk is similar but contains the U2 values. The third disk contains the unit keys U. Agent 1 takes the first disk and agent 2 takes the second disk. The third disk is used to program the chips. After the chips are programmed, all information is discarded from the vault and the agents leave. The laptop may be destroyed for additional assurance that no information is left behind. The protocol may be changed slightly so that four people are in the room instead of two. The first two would provide the seeds S1 and S2, and the second two (the escrow agents) would take the disks back to the escrow agencies. The escrow agencies have as yet to be determined, but they will not be the NSA, CIA, FBI, or any other law enforcement agency. One or both may be independent from the government. LAW ENFORCEMENT USE When law enforcement has been authorized to tap an encrypted line, they will first take the warrant to the service provider in order to get access to the communications line. Let us assume that the tap is in place and that they have determined that the line is encrypted with Clipper. They will first decrypt the law enforcement block with the family key F. This gives them E[K; U] + N. They will then take a warrant identifying the chip serial number N to each of the key escrow agents and get back U1 and U2. U1 and U2 are XORed together to produce the unit key U, and E[K; U] is decrypted to get the session key K. Finally the message stream is decrypted. All this will be accomplished through a special black box decoder operated by the FBI. ACKNOWLEDGMENT AND DISTRIBUTION NOTICE. All information is based on information provided by NSA, NIST, and the FBI. Permission to distribute this document is granted. --

3 2