Newsgroups: sci.crypt
Path: cantaloupe.srv.cs.cmu.edu!das-news.harvard.edu!noc.near.net!howland.reston.ans.net!wupost!mont!mizzou1.missouri.edu!C445585
From: C445585@mizzou1.missouri.edu (John Kelsey)
Subject: Corporate acceptance of the wiretap chip
Message-ID: <16BB51156.C445585@mizzou1.missouri.edu>
Sender: news@mont.cs.missouri.edu
Nntp-Posting-Host: mizzou1.missouri.edu
Organization: University of Missouri
References: <tcmayC5M2xv.JEx@netcom.com> <1qpg8fINN982@dns1.NMSU.Edu> <115863@bu.edu> <strnlghtC5nrHw.1qB@netcom.com> <pgf.735187239@srl03.cacs.usl.edu>
Date: Mon, 19 Apr 93 01:13:29 CDT
Lines: 60

 
strnlght@netcom.com (David Sternlight) writes:
>
>>What follows is my opinion. It is not asserted to be "the truth" so no
>>flames, please.  It comes out of a background of 20 years as a senior
>>corporate staff executive in two Fortune 50 companies.
>
>>I'd be happy to use a crypto system supplied by the NSA for business, if
>>they told me it was more secure than DES, and in particular resistant to
>>attempts by Japanese, French, and other competitive companies and
>>governments to break.
>
>>I'd be happy to do so even with escrowed keys, provided I was happy about
>>the bona fides of the escrow agencies (the Federal Reserve would certainly
>>satisfy me, as would something set up by one of the big 8 accounting firms).
 
   I don't doubt that this will be the attitude of many corporate leaders.
It's understandable--most corporate execs don't know much about cryptology,
and it's easy to get taken in by someone peddling snake oil.  And, the
proposed scheme *is* a major improvement in telephone security to what
exists now.
 
   The problem is that, with any security scheme of this kind, you have to
concern yourself with the weakest link in the chain.  I suspect that NSA
has put a fairly strong encryption algorithm in this wiretap chip of theirs,
probably at least as strong as (say) DES in OFB-mode.  Unfortunately, the
existence of the key-registry system seems to make possible all kinds of
possible attacks at a small fraction of the expense of trying to build (say)
a DES keysearch machine.
 
   As originally described, it sounded like any police / court combination
could acquire the key for a given chip.  I hope that's not the case, since
it would imply a glaring hole.  (How much does it cost to find *one* crooked
jodge and *one* crooked cop?  Especially for a foreign intelligence agency
or organized crime boss?)  However, even if more intelligent schemes are used
to allow access to the unencrypted phone conversations, there will be weak-
nesses.  They may be very expensive, and very difficult.  But who would
trust his/her confidential information to an encryption scheme that, for
(say) $100,000 could by cracked one time in a hundred?  (DES, for all the
complaints about a 56-bit key, would probably cost several million dollars
to build a keysearch machine for.)
 
   How many million dollars would the confidential phone messages of
the GM headquarters be worth to Nissan, Chrysler, or Audi?  How about
home phones of major execs and important engineers and designers?
"Gee, Mr Jones, I understand you've had some financial problems lately.
Maybe I can help..."
 
>>I'd trust something from the NSA long before I'd trust something from some
>>Swiss or anybody Japanese.
 
   Indeed, if NSA really designed the algorithm to be secure, it's very likely
as secure as IDEA or 2-key DES.  However, the system as a whole isn't resistant
to "practical cryptanalysis."  In _The Puzzle Palace_, Bamford describes how
several NSA employees were turned by foreign (presumably KGB) agents, despite
security measures that I doubt any Big 8 accounting firm could match.  And
NSA confidential data was *not* subject to being requested by thousands of
police organizations and courts across the land.
 
   --John Kelsey, c445585@mizzou1.missouri.edu
