reaction to Infoworld NIST/NSA queries

[""L. Detweiler"" <ld231782@longs.lance.colostate.edu>]

This is very interesting information, because it is extremely current
and represents the first direct reactions by the behind-the-scenes
authorities on some crucial aspects of Clipper and its scalding reception.

>   It should also be understood that the use of products
>   implementing the key escrow encryption microcircuit is
>   voluntary. There has been no attempt to either mandate its use
>   or to deny the entry of other encryption technologies into the
>   marketplace.

Note in the answer to `has acrimony lessened the government commitment'
the feeble whimpering ultimately falls back on the aspect that it is
voluntary. Ah, the last refuge of these scoundrels! If there are any
plans to restrict or limit domestic cryptography, the policy-makers
(and I use the term loosely) are painting themselves into a corner. If
the only redeeming feature of Clipper is that it is voluntary, then
anything less is wholly unredeeming! But again, the text conspicuously
does not rule out that option.

>   Finally, the system will be designed to ensure that law
>   enforcement destroys the keys it receives when its authority
>   to conduct the electronic surveillance has expired.

Correct me if I'm wrong, but this is the first time I've seen any
official indication of this requirement to `destroy keys after
surveillance' -- this *is* clearly an extremely serious weakness with
the scheme, and I don't use past tense there because this lip service
doesn't remedy it in the least. However, we can take consolation: it
appears there have been direct responses to the criticisms of the key
escrow aspects. In fact, they appear to have the key-escrow issues
thought out to the least (hence my very uneasy suspicions), were
surprised by the focused critical analysis, and have been consistently
attempting to strengthen the `baroque activities in a vault' (as one
esteemed cypherpunk put it). The attempts look a little bit like
desperate scramblings to me. They still don't have a clue on the escrow agencies!

>   Should a broader export policy be adopted, we
>   believe products implementing the key escrow technology will
>   find favor among consumers who desire the superb encryption
>   security offered.
 
`superb'? hee, hee. First claim of security outside of the `superior to
many other schemes on the market' weasel quote in the announcement.
This sounds like vintage Sternlight.

>Q. If Clipper would be the standard, would the use of non-Clipper
>   encryption devices be outlawed? If so, how would you find out
>   who was using these non-Clipper devices?
> 
>A. No. Use of key-escrowed products by the private sector would
>   be entirely voluntary.

here they appear to be directly suggesting that they will *not* attempt
domestic cryptographic restriction. (?)

>   Federal agencies will have the option
>   of using this technology once it becomes a Federal Information
>   Processing Standard.

This little FIPS thing (Federal Information Processing Standard) is
clearly very important to all the Clipper conspirators right now
(Bidzos is plugging it too, and it was in the PKP-NSA-DSA patent
agreement announcement). Is there some way to sabotage the FIPS
process? Cypherpunks, this is a critical window.

>A. NIST will recommend that DES be renewed for another five years
>   as a Federal Information Processing Standard.

wow, I don't recall seeing that before.

>A. Again, we must emphasize that use of this technology is
>   voluntary. Software containing other cryptosystems is still
>   available to consumers.

they plug the `voluntary' bit so much here you'd think they're talking
about Bush's Thousand Points of Light.

>A. We expect the key escrow microcircuits will be enhanced to keep
>   pace with future data requirements.

hee, hee. They can't even keep up with *current* requirements. The
chips last for an astonishingly durable 2 days. (Actually, with Clipper
this is a very attractive feature!)

>   That does not mean, however, that a government-imposed
>   security policy is appropriate. Government must be actively
>   involved in setting computer security standards for its own
>   use and making its technology, expertise and guidance
>   available to the private sector when requested and
>   appropriate.

wow. At first I thought this was a typo and the statement was supposed
to be `does not mean it is *in*appropriate'.  `when requested and
appropriate'? Good lord, is this the NSA talking or did they have the
day off? Maybe they actually understand they have no domestic legal
regulatory standing whatsoever.