CSSPAB Questions Clipper Govt. Panel Questions Clipper Chip Proposal By David Banisar, The Privacy Times After two days of sometimes tumultuous hearings, a government advisory board chartered to advise the administration and Congress on computer security and privacy issued two resolutions questioning many of the aspects of the Clinton Administration's controversial new encryption scheme, the Clipper Chip. The National Institute for Standards and Technology's Computer System Security and Privacy Advisory Board (CSSPAB) expressed continued concern over many aspects of the proposal including the lack of a convincing statement expressing the problems that the Clipper is supposed to solve, the need to look for possible alternatives to the proposal, the legal, economic, export controls issues, and software implementation of the proposal. In addition, the board also expressed concern that the Clipper proposal could negatively impact the availability of cost-effective security products to the US government and industry and that it may not be marketable or usable worldwide. In a second resolution, the board unanimously called for a public debate of the proposal and recommended that Congress take an active role in determining US cryptography policy. It also recommended that any new policy must address the interests of law enforcement and intelligence, US industry and citizens' privacy and security in the US and worldwide. At the hearings, Geoff Greiveldinger from the Department of Justice reported that the key escrow agents will be announced within a few weeks after briefing members of Congress. Sources inside the administration indicate that the administration may have decided to eliminate from consideration outside organizations holding the keys and are leaning towards the Department of the Treasury as one of the key holders. Doug Miller of the Software Publishers Association (SPA) also presented the latest survey of foreign software with cryptography finding that over 200 products from over 20 countries were available from overseas companies including many that use DES. He expressed concern that the Clipper chip would harm the US software industry while not providing any benefits to the intelligence community, since cryptography was available worldwide. He indicated that they were seeking a legislative solution to the issue. Last year, a renewal of the Export Administration Act t, which removed restrictions on off-the-shelf software with encryption, was vetoed by President Bush. NIST Deputy Director Ray Kammer announced that the Data Encryption Standard (DES) will be recertified for government, non-classified use for another five years. The paperwork has been sent to Secretary of Commerce Ron Brown, who is expected to sign it within two weeks. The Clipper proposal was introduced April 16, 1993 and has been strongly opposed by both civil liberties groups and industry. The proposal calls for use of a secret encryption chip designed by the National Security Agency for non-classified voice and data transmission. The keys for the chip would be split and held in escrow by two government agencies. NIST has submitted the Clipper proposal for public comment. The FIPS was published in the Federal Register at Volume 58, page 40791 (July 30, 1993) and is also available in electronic form from the CPSR Internet Library FTP/WAIS/Gopher cpsr.org /cpsr/crypto/clipper/call-for-comments. Comments are due to NIST by September 28, 1993 to the Director, Computer Systems Laboratory, ATTN: Proposed FIPS for Escrowed Encryption Standard, Technology Building, room B-154, National Institute of Standards and Technology, Gaithersburg, MD 20899. CPSR has created an archive of comments on the proposal and has asked people to electronically submit a copy of their comments to clipper@washofc.cpsr.org. -------------------------------- NON-CERTIFIED TEXT COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD RESOLUTION 93-5 SEPTEMBER 1-2, 1993 Subsequent to the June 2-4, 1993 meeting of the CSSPAB, the Board has held an addition 4 days of public hearings and has collected additional public input. The clear message is that the preliminary concerns stated in Resolution 1 of that date have been confirmed as serious concerns which need to be resolved. Public input has heightened the concerns of the Board to the following issues: - A convincing statement of the problem that Clipper attempts to solve has not been provided. - Export and import controls over cryptographic products must be reviewed. Based upon data compiled from US and international vendors, current controls are negatively impacting US competitiveness in the world market and are not inhibiting the foreign production and use of cryptography (DES and RSA). - The Clipper/Capstone proposal does not address the needs of the software industry, which is critical and significant component of the National Information Infrastructure and the US economy. - Additional DES encryption alternatives and key management alternatives should be considered since there is a significant installed base. - The individuals reviewing the Skipjack algorithm and key management system must be given an appropriate time period and environment in which to perform a thorough review. This review must address the escrow protocol and chip implementation as well as the algorithm itself. - Sufficient information must be provided on the proposed key escrow scheme to allow it to be fully understood by the general public. - Further development and consideration of alternatives to the key escrow scheme need to be considered, e.g., three "escrow" entities, one of which is a non-government agency, and a software based solution. - The economic implications for the Clipper/Capstone proposal have not been examined. These costs go beyond the vendor cost of the chip and include such factors as customer installation, maintenance, administration, chip replacement, integration and interfacing, government escrow system costs, etc. - Legal issues raised by the proposal must be reviewed. - Congress, as well as the administration, should play a role in the conduct and approval of the results of the review. Moreover, the following are additional concerns of the Board. - Implementation of the Clipper initiative may negatively impact the availability of cost-effective security products to the US government and the private sector; and - Clipper products may not be marketable or usable worldwide. FOR: Castro, Gangemi, Lambert, Lipner, Kuyers, Philcox, Rand, Walker, Whitehurst, and Zeitler. AGAINST: none ABSTAIN Gallagher [NSA] ABSENT: Colvin ----------------------------------------------------------------- NON-CERTIFIED TEXT COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD RESOLUTION 93-6 SEPTEMBER 1-2, 1993 The Board believes that in deciding cryptographic policies and standards in the US, there is a compelling need to consider and evaluate the concerns listed below. We, therefore, endorse the process being pursued by the administration in the form of an interagency review but believe the scope of that review needs to include adequate industry input. We reaffirm our recommendations (of March 1992) that the issues surrounding this policy be debated in a public forum. In view of the worldwide significance of these issues the Board believes that the Congress of the U.S. must be involved in the establishment of cryptographic policy. The board, furthermore, believes that there are a number of issues that must be resolved before any new or additional cryptographic solution is approved as a US government standard: 1. The protection of law enforcement and national security interests. 2. The protection of U.S. computer and telecommunications interests in the international marketplace. 3. The protection of U.S. person's interests both domestically and internationally. FOR: Castro, Gallagher, Gangemi, Lambert, Lipner, Kuyers, Philcox, Rand, Walker, Whitehurst, and Zeitler. AGAINST: none ABSTAIN: none ABSENT: Colvin