Xref: cantaloupe.srv.cs.cmu.edu comp.org.eff.talk:16968 sci.crypt:15429 Newsgroups: comp.org.eff.talk,sci.crypt Path: cantaloupe.srv.cs.cmu.edu!crabapple.srv.cs.cmu.edu!fs7.ece.cmu.edu!europa.eng.gtefsd.com!howland.reston.ans.net!zaphod.mps.ohio-state.edu!sdd.hp.com!network.ucsd.edu!munnari.oz.au!uniwa!cujo!cc.curtin.edu.au!zrepachol From: zrepachol@cc.curtin.edu.au (Paul Repacholi) Subject: Re: Clipper Chip. LONG follow up. Message-ID: <1993Apr20.030538.1@cc.curtin.edu.au> Lines: 478 Sender: news@cujo.curtin.edu.au (News Manager) Organization: Curtin University of Technology References: <16695@rand.org> Date: Mon, 19 Apr 1993 18:05:38 GMT In article <16695@rand.org>, jim@rand.org (Jim Gillogly) writes: > This document is in the anonymous ftp directory at NIST. Looks to me > like the other shoe has dropped. > > Jim Gillogly > Trewesday, 25 Astron S.R. 1993, 17:00 > Thanks for posting this and making it available. This post will be LONG, I will comment on most of it, and am reluctantly leaving all of the original in place to provide context. Please note that an alt. group has been set up for the Clipper stuff. > ------------------- > > Note: This file will also be available via anonymous file > transfer from csrc.ncsl.nist.gov in directory /pub/nistnews and > via the NIST Computer Security BBS at 301-948-5717. > --------------------------------------------------- > > THE WHITE HOUSE > > Office of the Press Secretary > > _________________________________________________________________ > > For Immediate Release April 16, 1993 > > > STATEMENT BY THE PRESS SECRETARY > > > The President today announced a new initiative that will bring > the Federal Government together with industry in a voluntary ^^^^^^^^^ Hum, AT&T, VLSI and Mykotronx are 'industry'? Wonder what happened to IBM, this should be right up their street. And a mandateed scheme is voluntary? Mr Orwell would love this. > program to improve the security and privacy of telephone ^^^^^^^^^ > communications while meeting the legitimate needs of law > enforcement. Telephone encryption and scrambleing are years behind digital ones like RSA, IDEA, or even DES. The above, while literaly true, is a clasic straw-man claim in the context of non-real-time circuits such as E-mail and the like. > The initiative will involve the creation of new products to > accelerate the development and use of advanced and secure > telecommunications networks and wireless communications links. > I would modestly propose that a mandated use of ISDN would do more for commun- ications than this lot. > For too long there has been little or no dialogue between our > private sector and the law enforcement community to resolve the > tension between economic vitality and the real challenges of > protecting Americans. Rather than use technology to accommodate > the sometimes competing interests of economic growth, privacy and > law enforcement, previous policies have pitted government against > industry and the rights of privacy against law enforcement. > > Sophisticated encryption technology has been used for years to > protect electronic funds transfer. It is now being used to > protect electronic mail and computer files. While encryption Normmaly DES. > technology can help Americans protect business secrets and the ^^^^^^^^^^^^^^^^ > unauthorized release of personal information, it also can be used > by terrorists, drug dealers, and other criminals. Note the use of the word "business" in the above. The whole tenor of this release seems to be establishing a ground rule that only "business" use is legitimate for debate. If you want the nothings you drop in your wife's ear to remain secret and private, that is not even on the agenda for debate. Note that there is NO role for you to contain private info in this. The only reference is to information already in the hands of others. The 'unauthorized release' bit is also drawing a long bow. Most of these cases are by people who have legitimate access abusing it, and revealing, or often selling the info. These people are, of course, in this proposal, the people who will have the keys. The criminals also use lawers, courts, the CIA, white-house officials and pens to go about their business. When will they be outlawed as well? Yeah, several of them would be a better idea than CLipper! Them again, the protections of law and the courts have been seriously erroded over the last decade ofr so. > A state-of-the-art microcircuit called the "Clipper Chip" has > been developed by government engineers. The chip represents a ^^^^^^^^^^^^^^^^^^^^ NSA > new approach to encryption technology. Yeah, this bit is VERY true. >....It can be used in new, > relatively inexpensive encryption devices that can be attached to > an ordinary telephone. It scrambles telephone communications > using an encryption algorithm that is more powerful than many in > commercial use today. > Note the repeated mixing of telephone scrabeling and encryption. A demo of the above claim on an ordanary POTS would be a good nights entertainment I suspect. Note also the 'many'. not 'all', as the general tone implies. > This new technology will help companies protect proprietary ^^^^^^^^^ > information, protect the privacy of personal phone conversations ^^^^^^^^^^^^^^ > and prevent unauthorized release of data transmitted > electronically. At the same time this technology preserves the > ability of federal, state and local law enforcement agencies to > intercept lawfully the phone conversations of criminals. The case record seems to indicate that what is needed is a brutal tightening of the current abuses. I have not heard, yet, of a case that was impeaded by the use of secure encryption by the men in black. The other side, abuse by law enforcers is well documented, even by govt agencies. And the phone vs other coms is blurred yet again. > A "key-escrow" system will be established to ensure that the > "Clipper Chip" is used to protect the privacy of law-abiding > Americans. > A "key-escrow" system will be established to ensure that the > "Clipper Chip" is used to protect the privacy of law-abiding > Americans. Lets run that line twice. Not **VERY** carefully what it says. The stated purpose of the key eschrow is to make the use of Clipper compulsory. Note the word "ensure". As to 'protect', or 'law-abiding', I will leave to you. So to the person who asked if it included the outlawing of other encryptions, the answer in this press release is, YES. > ...Each device containing the chip will have two unique > "keys," numbers that will be needed by authorized government > agencies to decode messages encoded by the device. When the > device is manufactured, the two keys will be deposited separately > in two "key-escrow" data bases that will be established by the > Attorney General. Access to these keys will be limited to > government officials with legal authorization to conduct a > wiretap. Just as they only can wiretap now with a warrent. > The "Clipper Chip" technology provides law enforcement with no > new authorities to access the content of the private > conversations of Americans. Just makes sure that the illegal ones are preserved. > To demonstrate the effectiveness of this new technology, the > Attorney General will soon purchase several thousand of the new > devices. In addition, respected experts from outside the > government will be offered access to the confidential details of > the algorithm to assess its capabilities and publicly report > their findings. Where do you find many experts. Any ex KGB people looking for a contract? :-) And as a later posting asks, what of the STU-IIIs they already have. It will be very interesting to see if the military and US embasies start to use it. After all, it is secure, isn't it. The govt will answer that point by its own actions. > The chip is an important step in addressing the problem of > encryption's dual-edge sword: encryption helps to protect the > privacy of individuals and industry, but it also can shield > criminals and terrorists. We need the "Clipper Chip" and other > approaches that can both provide law-abiding citizens with access > to the encryption they need and prevent criminals from using it > to hide their illegal activities. In order to assess technology > trends and explore new approaches (like the key-escrow system), > the President has directed government agencies to develop a > comprehensive policy on encryption that accommodates: > > -- the privacy of our citizens, including the need to > employ voice or data encryption for business purposes; ^^^^^^^^ Again, personal use seems to be a unaskable question. > > -- the ability of authorized officials to access telephone > calls and data, under proper court or other legal ^^^^^ > order, when necessary to protect our citizens; Ah, so warrents are not always needed it seems. > > -- the effective and timely use of the most modern > technology to build the National Information > Infrastructure needed to promote economic growth and > the competitiveness of American industry in the global > marketplace; and > > -- the need of U.S. companies to manufacture and export > high technology products. The ITARs seem to slightly impeed this. > The President has directed early and frequent consultations with > affected industries, the Congress and groups that advocate the > privacy rights of individuals as policy options are developed. > The Administration is committed to working with the private > sector to spur the development of a National Information > Infrastructure which will use new telecommunications and computer > technologies to give Americans unprecedented access to > information. This infrastructure of high-speed networks > ("information superhighways") will transmit video, images, HDTV > programming, and huge data files as easily as today's telephone > system transmits voice. Note that all this wonderfull stuff will be in secret. Only the 'proper people' will be able to express an opinion, hence only the desired result will emerge. > Since encryption technology will play an increasingly important > role in that infrastructure, the Federal Government must act > quickly to develop consistent, comprehensive policies regarding > its use. The Administration is committed to policies that > protect all Americans' right to privacy while also protecting > them from those who break the law. Encryption and codes have been around for millenia. They are generaly in equilibrium with the technology of the time. The systematic study of cyphers has resulted in a swing in favor of the encrypter, AT THE MOMENT. I have no doubt that the factoring problem will fall in time. Probably fofr practical purposes by the middle of the next century. > Further information is provided in an accompanying fact sheet. > The provisions of the President's directive to acquire the new > encryption technology are also available. > > For additional details, call Mat Heyman, National Institute of > Standards and Technology, (301) 975-2758. > > --------------------------------- > > > QUESTIONS AND ANSWERS ABOUT THE CLINTON ADMINISTRATION'S > TELECOMMUNICATIONS INITIATIVE > > > > > Q: Does this approach expand the authority of government > agencies to listen in on phone conversations? > > A: No. "Clipper Chip" technology provides law enforcement with > no new authorities to access the content of the private > conversations of Americans. > > Q: Suppose a law enforcement agency is conducting a wiretap on > a drug smuggling ring and intercepts a conversation > encrypted using the device. What would they have to do to > decipher the message? > > A: They would have to obtain legal authorization, normally a > court order, to do the wiretap in the first place. They > would then present documentation of this authorization to > the two entities responsible for safeguarding the keys and > obtain the keys for the device being used by the drug > smugglers. The key is split into two parts, which are > stored separately in order to ensure the security of the key > escrow system. > > Q: Who will run the key-escrow data banks? > > A: The two key-escrow data banks will be run by two independent > entities. At this point, the Department of Justice and the > Administration have yet to determine which agencies will > oversee the key-escrow data banks. It is a little hard to critisise a non-proposal. > Q: How strong is the security in the device? How can I be sure > how strong the security is? > > A: This system is more secure than many other voice encryption > systems readily available today. Note we drop back to 'phone-mode' again. If this is a true answer, it can be rephrased as " It sucks big time. Anyone who can drive the crypt work-bench will use it for light amusement before breakfast." > ... While the algorithm will > remain classified to protect the security of the key escrow > system, This link between the security of the key-eschrow, and the actual algorithm is a real winner. Given that I have 2 secret 40 bit numbers, could someone please explain how the details of an encryption algorithm will reveal them? > ... we are willing to invite an independent panel of > cryptography experts to evaluate the algorithm to assure all > potential users that there are no unrecognized > vulnerabilities. Just make sure you read the CVs REAL carfully, OK. > > Q: Whose decision was it to propose this product? > > A: The National Security Council, the Justice Department, the > Commerce Department, and other key agencies were involved in > this decision. This approach has been endorsed by the > President, the Vice President, and appropriate Cabinet > officials. Quick, with out looking back, What name is missing from that list? > Q: Who was consulted? The Congress? Industry? > > A: We have on-going discussions with Congress and industry on > encryption issues, and expect those discussions to intensify > as we carry out our review of encryption policy. We have > briefed members of Congress and industry leaders on the > decisions related to this initiative. The people who agree with us and who think there is a buck in it for them. > Q: Will the government provide the hardware to manufacturers? > > A: The government designed and developed the key access > encryption microcircuits, but it is not providing the > microcircuits to product manufacturers. Product > manufacturers can acquire the microcircuits from the chip > manufacturer that produces them. The reverse engineering provisions of the 'Mask-work' act could be relevent here. > Q: Who provides the "Clipper Chip"? > > A: Mykotronx programs it at their facility in Torrance, > California, and will sell the chip to encryption device > manufacturers. The programming function could be licensed > to other vendors in the future. > > Q: How do I buy one of these encryption devices? > > A: We expect several manufacturers to consider incorporating > the "Clipper Chip" into their devices. You don't. Not unless you are one of the 'right people'. > Q: If the Administration were unable to find a technological > solution like the one proposed, would the Administration be > willing to use legal remedies to restrict access to more > powerful encryption devices? > > A: This is a fundamental policy question which will be > considered during the broad policy review. The key escrow They missed the word secret here. He needs a grammar lesson too. > mechanism will provide Americans with an encryption product > that is more secure, more convenient, and less expensive > than others readily available today, but it is just one > piece of what must be the comprehensive approach to > encryption technology, which the Administration is > developing. I would say "less secure, less conveniant, more expensive ( PGP is free ), less available, and more prone to being comprimised" Proofs to the contarary will be welcome. Note PROOF. > The Administration is not saying, "since encryption > threatens the public safety and effective law enforcement, > we will prohibit it outright" (as some countries have > effectively done); nor is the U.S. saying that "every > American, as a matter of right, is entitled to an > unbreakable commercial encryption product." They don't seem to be saying anything that makes much sense. And this proposal DOES prohibit it except in a very limited way. And, this is the one explicit reference to personal rights. It is a denial. And yes, I don't think that the Mexicans, Brazilians, and Canucks are included in Clinton et als magnanamous gesture. > ... There is a > false "tension" created in the assessment that this issue is > an "either-or" proposition. Rather, both concerns can be, > and in fact are, harmoniously balanced through a reasoned, > balanced approach such as is proposed with the "Clipper > Chip" and similar encryption techniques. The 'false tension' is false. The balance is between two repugnant points. The RIGHT to privacy is hand-waved to non-existance by putting it behind the "false assessment". It is assumed that the removal of the right to take what ever steps YOU deem suitable to protect YOUR privacy is non negotiable, hence is defined in the govenment language to be non-existant. If you don't agree, you must be a criminal, as only criminals don't agree with out laws. Also note the non- question. "If what is here was not possible..." > Q: What does this decision indicate about how the Clinton > Administration's policy toward encryption will differ from > that of the Bush Administration? > > A: It indicates that we understand the importance of encryption > technology in telecommunications and computing and are > committed to working with industry and public-interest > groups to find innovative ways to protect Americans' > privacy, help businesses to compete, and ensure that law > enforcement agencies have the tools they need to fight crime > and terrorism. It indicates we know that Bush dropped the ball in squashing that nasty < insert suitable retoric > and will stamp out this disorderly, unruley outbreak of freedom and ultra-national sentiment. > Q: Will the devices be exportable? Will other devices that use > the government hardware? > > A: Voice encryption devices are subject to export control > requirements. Case-by-case review for each export is > required to ensure appropriate use of these devices. The > same is true for other encryption devices. One of the > attractions of this technology is the protection it can give > to U.S. companies operating at home and abroad. With this > in mind, we expect export licenses will be granted on a > case-by-case basis for U.S. companies seeking to use these > devices to secure their own communications abroad. We plan > to review the possibility of permitting wider exportability > of these products. > This one is a real giggle. In Australia or France, they will have to reveal the keys, and the algorithm. Don't think it's at the top of my list of things I must have, so the restrictions will protect me from saleks trying to sell me a bill of crock. Any for any others using it, they must be nuts! Good luck folks. ~Paul