Subject: Re: Notes on key escrow meeting with NSA (Blaze, RISKS-15.48)

From: [email-masked] (Roy M. Silvernail)
Date: Thu, 10 Feb 1994 22:45:12 CST

> The LEAF field contains 80 bits for the traffic key, encrypted via the unit
> key in "~a unique mode <grin>~", 32 bits for the unit id, and a 16 bit
> checksum of some sort.  (We didn't waste our breath asking what the checksum
> algorithm was.)  This is all encrypted under the family key using "~another
> mode <grin>~".

One of my concerns from the beginning of the Clipper/Capstone proposal was
that the LEAF would not be protected to the same extent as the primary
traffic.  This paragraph confirms that the LEAF is encrypted at least
differently.

The RISK here is that the session keys may be vulnerable to a less rigorous
cryptographic attack than the traffic itself.  So it may not be necessary to
even go through the dance with the escrow agencies to compromise a
Clipper/Capstone chip.  Of course, the Skipjack algorithm would still be
required for decrypting the traffic, but it would still appear that this is a
vulnerability.  I wish this point had come out earlier.

Roy M. Silvernail    [email-masked]