Re: Black Eye for NSA, NIST, and Denning

[Hal <hfinney@shell.portal.com>]

It was my understanding from what was posted here and on sci.crypt that
Clipper chips were only going to be given to phone manufactureres who
had an approved design.  This would mean no pre-encryption of messages,
and no hacks to defeat the LEAF block, would be allowed.

It's not clear to me whether the same restrictions apply to the use of
the Tessera plug-in card.  It sounds, from what was posted here, like
Blaze was able to feed sample LEAF's at his card until it accepted one.
Is that correct?  If so, apparently users of such cards have access to
low-level functions which would allow this kind of trick to be used.

Unless there is some way to get a supply of Clipper chips to allow you
to make Clipper-compatible phones which still protect privacy, then
all this theorizing is not too useful.

I am inclined to agree with Deadbeat that if you want to give the
impression that you are using Clipper on your phone calls (to blend in,
to keep a low profile) but at the same time you want the key escrow not
to work, then pre-encryption is a superior strategy to Matt Blaze's
idea.  Matt's trick only hides the session key if both sides are using
it.  And even in that case it appears to require particular key manage-
ment techniques that may not be standard (one side provides the session
key, or it is negotiated but both sides wait 30 minutes to talk).  So it
does seem that some pre-arrangement will be necessary in practice to allow
Blaze's approach to successfully hide the session key.

It's true that the Blaze technique hides the unit id, preventing traffic
analysis.  But that could be a negative.  Playing paranoid, suppose that
Clipper traffic is routinely decrypted with the family key.  Then the
fact that someone is using bogus LEAF's might be evident because the
unit id would change with each call.  Using pre-encryption makes you look
like a good little boy until they bring out the escrowed keys.


(Of course, they're not supposed to troll LEAF's, any more than they're
supposed to break escrow, but I'm assuming that the former will be easier
and more likely than the latter.)

Hal