Re: Black Eye for NSA, NIST, and Denning

[Adam Shostack <adam@bwh.harvard.edu>]

deadbeat wrote:

| On the one hand, I applaud Dr. Blaze for the discoveries based on his
| black-box analysis of the NSA product.  How fortunate to have him
| working in a laboratory seeded with this gear.
| 
| On the other hand, I am amused at the "big deal" being made about such
| a minor result.  This "protocol failure" exposes the NSA product to no
| new threats.  If one's objective is to use SKIPJACK but to defeat key
| escrow, pre-encryption is easier, conceptually simpler, and may be more
| secure, depending on what is actually inside the SKIPJACK code.

	Actually, Blaze's work does nullify one important aspect of
Clipper that pre-encryption does not address, and that is traffic
analasis.

Adam


-- 
Adam Shostack 				       adam@bwh.harvard.edu

Politics.  From the greek "poly," meaning many, and ticks, a small,
annoying bloodsucker.