Subject: Re: Flaw in Clipper detected (Huggins, RISKS-16.11)

From: Paul Carl Kocher <[email-masked]>
Date: Tue, 7 Jun 1994 03:19:55 -0700

Although I doubt people will modify devices with hard-wired Clipper chips,
this is seems to be a very serious blow to Tessera (the government's PCMCIA
card with a Clipper chip).

Tessera has a standard programming interface that passes the programmer's
calls to the encryption card.  Any experienced assembly language programmer
could easily add "support" for Blaze's technique for bypassing the LEAF (Law
Enforcement Access Field) validation check.  This could be done transparently
and without significantly impacting performance.  It could also fix up the
side effects of the attack (e.g. the first block is bad in CBC mode, etc).
Under MSDOS this could be done with a TSR that would intercept calls to the
card directly, so it would work with all Tessera applications.  The same TSR
could also substitute pre-computed and/or brute-forced LEAFs for
interoperability with non-cheating users.

We were told that the reason for having escrowed keys and a secret algorithm
was to keep terrorists from having strong crypto.  Now the bad guys have
full-strength SkipJack, the public has a flawed "standard," and because the
algorithm is classified we can't look for other problems.  I'm also wondering
what's going on inside NSA -- DSS originally had alarmingly-small keys and has
been widely criticized, SHA was defective, and now this...

-- Paul Kocher  [email-masked]