Xref: cantaloupe.srv.cs.cmu.edu alt.privacy.clipper:90 sci.crypt:15815
Path: cantaloupe.srv.cs.cmu.edu!das-news.harvard.edu!noc.near.net!uunet!digex.com!digex.com!not-for-mail
From: steve-b@access.digex.com (Steve Brinich)
Newsgroups: alt.privacy.clipper,sci.crypt
Subject: Re: Is key escrow enough?
Date: 22 Apr 1993 23:53:42 -0400
Organization: Express Access Online Communications, Greenbelt, MD USA
Lines: 14
Distribution: world
Message-ID: <1r7p86$82@access.digex.net>
References: <1993Apr22.043233.8855@uc.msc.edu> <Apr22.185314.14420@yuma.ACNS.ColoState.EDU> <strnlghtC5wL17.6wB@netcom.com> <1993Apr22.231517.18659@wdl.loral.com>
NNTP-Posting-Host: access.digex.net

  The points raised about checking what is actually -in- the chip, as
opposed to what is allegedly programmed therein, raise yet another trust
issue.  Even if we assume that these "trusted agents" are really entering
a wide range of S1 and S2 seeds (rather than using the same one all the
time to reduce the key search space to 30 bits), I assume they are not
doing so by picking up an iron filing and poking it into the circuitry
at carefully selected points to encode data.  They would presumably be
punching numbers into a computer, which for all they know could program
the chips in a manner completely independent of the S1 and S2 values they
are feeding into the system.




