hallam@zorch.w3.org (Phillip M. Hallam-Baker) wrote:

The code looks more than a casual hoax. Its not Skipjack, but that does not mean its not NSA originated. Its probable that many of the people who designed skipjack don't know its skipjack. If you read the code carefully it is obvious why its not skipjack, an S2 algorithm is referenced explicitly.

[...]

Regardless about whether or not it is skipjack it challenges one of the basic assumptions of many cipher designers, namely that the amount of diffussion should be maximized at each round. I am now very much less than convinced that this is in fact an issue. The S1 design with its narrow diffussion provides very strong guarantees that one round cannot undo the work of the previous one.

S1 must therefore be considered to be a significant contribution to the cryptographic community. It has challenged a fundamental tenet of faith which has so far been accepted without argument. It is thus paradigmatic in that it may lead to a new method of cipher design.

Does anyone remember the scenario someone suggested awhile back that hypothesized a scheme by the NSA or other TLAs to encourage the use of WEAK crypto? It involved spreading a lot of F.U.D. about PGP and other strong crypto methods, followed by the discovery/leak of a supposedly "strong" crypto algorithm to replace it. This may not be it. It may just be a trial balloon to gauge the reaction of the crypto community to an anonymous, "gift from heaven" crypto algorithm. But at least be aware of what COULD happen. One tactic that might be tried is an intentional "leak", followed by a flurry of legal actions designed to make it look like the "leak" was going to cause some real damage to their cryptanalysis efforts, due to it being "unbreakable", or whatever. Of course, anything "leaked" would be crippled in some undetectable manner so as to provide a back door...