RE: Announcement: RPK InvisiMail released on 12 Jan, 1998

[John Young <jya@pipeline.com>]

On "using honey not vinegar" rationale of RPK InvisiMail for
obtaining crypto export licenses:

Applied Cryptography, Bruce Schneier, 2nd Edition, pp. 215-16

Algorithms for Export

Algorithms for export out of the United States must be approved 
by the U.S. government (actually, by the NSA--see Section 25.1)
It is widely believed that these export-approved algorithms can 
be broken by the NSA. Although no one has admitted this on the 
record, these are some of the things the NSA is rumored to privately
suggest to companies wishing to export their cryptographic products:

  - Leak a key bit once in a while, embedded in the ciphertext.

  - "Dumb down" the effective key to something in the 30-bit range. 
  For example, while the algorithm might accept a 100-bit key, most 
  of those keys might be equivalent.

  - Use a fixed IV, or encrypt a fixed header at the beginning of 
  each encrypted message. This facilitates a known-plaintext attack.

  - Generate a few random bytes, encrypt them with the key, and then
  put both the plaintext and the ciphertext of those random bytes at 
  the beginning of the encrypted message. This also facilitates a 
  known-plaintext attack.

NSA gets a copy of the source code, but the algorithm's details remain 
secret from everyone else. Certainly no one advertises any of these 
deliberate weaknesses, but beware if you buy a U.S. encryption product 
that has been approved for export.

-----

Bruce added the last "beware" phrase to the 2nd edition.