Subject: Notes on key escrow meeting with NSA

From: [email-masked] (Matt Blaze)
Date: Wed, 2 Feb 1994 21:02:55 GMT

A group from NSA and FBI met the other day with a group of us at Bell
Labs to discuss the key escrow proposal.  They were surprisingly
forthcoming and open to discussion and debate, and were willing to at
least listen to hard questions.  They didn't object when asked if we
could summarize what we learned to the net.  Incidentally, the people
at the meeting seemed to base a large part of their understanding of
public opinion on Usenet postings.  Postings to sci.crypt and
talk.politics.crypto seem to actually have an influence on our
government.

A number of things came out at the meeting that we didn't previously
know or that clarified previously released information.  What follows
is a rough summary; needless to say, nothing here should be taken as
gospel, or representing the official positions of anybody.  Also,
nothing here should be taken as an endorsement of key escrow, clipper,
or anything else by the authors; we're just reporting.  These notes
are based on the collective memory of Steve Bellovin, Matt Blaze, Jack
Lacy, and Mike Reiter; there may be errors or misunderstandings.
Please forgive the rough style.  Note also the use of "~ ~" for
'approximate quotes' (a marvelous Whit Diffie-ism).

NSA's stated goals and motives for all this:
	* DES is at the end of its useful life
	* Sensitive, unclassified government data needs protection
	* This should be made available to US Citizens
	* US business data abroad especially needs protection
	* The new technology should not preclude law enforcement access

They indicated that the thinking was not that criminals would use key
escrowed crypto, but that they should not field a system that
criminals could easily use against them.  The existence of key escrow
would deter them from using crypto in the first place.  The FBI
representative said that they expect to catch "~only the stupid
criminals~" through the escrow system.

Another stated reason for key escrow is that they do not think that
even government-spec crypto devices can be kept physically secure.
They do expect enough to be diverted to the black market that they feel
they need a response.  NSA's emphasis was on the foreign black market...

There seems to be a desire to manipulate the market, by having the
fixed cost of key escrow cryptography amortized over the government
market.  Any private sector devices would have to sell a much larger
number of units to compete on price.  (This was somewhere between an
implication and an explicit statement on their part.)

When asked about cryptography in software, "~...if you want US
government cryptography, you must do it with hardware~".

Clipper chips should be available (to product vendors) in June.  You
can't just buy loose chips - they have to be installed in approved
products.  Your application interface has to be approved by NIST for
you to get your hands on the chips.

An interesting point came up about the reverse-engineering resistance
of the chips: they are designed to resist reverse engineering the data
in the chip without destroying the chip.  It is not clear (from the
information presented at the meeting) whether the chips are equally
resistant to destructive reverse-engineering to learn the skipjack
algorithm.   They said the algorithm was patented, but they may have
been joking.  ("~And if that doesn't scare you enough, we'll turn the
patent over to PKP.~")

The resistance to reverse engineering is not considered absolute by
NSA.  They do feel that "~it would require the resources of a national
laboratory, and anyone with that much money can design their own
cryptosystem that's just as strong.~"

They repeated several times that there are "~no plans to regulate the
use of alternate encryption within the US by US citizens.~"  They also
indicated they "~weren't naive~" and didn't think that they could if
they wanted to.

There were 919 authorized wiretaps, and 10,000 pen register monitors,
in 1992.  They do not have any figures yet on how often cryptography
was used to frustrate wiretaps.

They do not yet have a production version of the "decoder" box used by
law enforcement.  Initially, the family key will be split (by the same
XOR method) and handled by two different people in the athorized
agencies.  There is presently only one family key.  The specifications
of the escrow exploitation mechanism are not yet final, either; they
are considering the possibility of having the central site strip off
the outer layers of encryption, and only sending the session key back
to the decoder box.

The escrow authorities will NOT require presentation of a court order
prior to releasing the keys.  Instead, the agency will fill out a form
certifying that they have a legal authorization.  This is also backed
up with a separate confirmation from the prosecutor's office.  The
escrow agencies will supply any key requested and will not themselves
verify that the keys requested are associated with the particular court
order.

The NSA did not answer a question as to whether the national security
community would obtain keys from the same escrow mechanism for their
(legally authorized) intelligence gathering or whether some other
mechanism would exist for them to get the keys.

The masks for the Clipper/Capstone chip are unclassified (but are
protected by trade secret) and the chips can be produced in an
unclassified foundry.  Part of the programming in the secure vault
includes "~installing part of the Skipjack algorithm.~" Later
discussion indicated that the part of the algorithm installed in the
secure vault are the "S-tables", suggesting that perhaps unprogrammed
Clipper chips can be programmed to implement other 80-bit key, 32 round
ciphers.

The Capstone chip includes an ARM-6 RISC processor that can be used for
other things when no cryptographic functions are performed.  In
particular, it can be used by vendors as their own on-board processor.
The I/O to the processor is shut off when a crypto operation is in
progress.

They passed around a Tessera PCMCIA (type 1) card.  These cards
contain a Capstone chip and can be used by general purpose PC
applications.  The cards themselves might not be export controlled.
(Unfortunately, they took the sample card back with them...)  The card
will digitally sign a challenge from the host, so you can't substitute
a bogus card.  The cards have non-volatile onboard storage for users'
secret keys and for the public keys of a certifying authority.

They are building a library/API for Tessera, called Catapult, that
will provide an interface suitable for many different applications.
They have prototype email and ftp applications that already uses it.
They intend to eventually give away source code for this library.
They responded favorably to the suggestion that they put it up for
anonymous ftp.

Applications (which can use the library and which the NSA approves for
government use) will be responsible for managing the LEAF field.  Note
that they intend to apply key escrowed Skipjack to other applications,
including mail and file encryption.  The LEAF would be included in
such places as the mail header or the file attributes.  This implies
that it is possible to omit sending the LEAF -- but the decrypt chip
won't work right if it doesn't get one.

When asked, they indicated that it might be possible wire up a pair of
Clipper/Capstone chips to not transmit the LEAF field, but that the
way to do this is "~not obvious from the interface we give you~" and
"~you'd have to be careful not to make mistakes~".  They gave a lot of
attention to obvious ways to get around the LEAF.

The unit key is generated via Skipjack itself, from random seeds
provided by the two escrow agencies (approximately monthly, though
that isn't certain yet).  They say they prefer a software generation
process because its correct behavior is auditable.

Capstone (but not Clipper) could be configured to allow independent
loading of the two key halves, in separate facilities.  "~It's your
money [meaning American taxpayers].~"

The LEAF field contains 80 bits for the traffic key, encrypted via the
unit key in "~a unique mode <grin>~", 32 bits for the unit id, and a 16
bit checksum of some sort.  (We didn't waste our breath asking what the
checksum algorithm was.)  This is all encrypted under the family key
using "~another mode <grin>~".

They expressed a great deal of willingness to make any sort of
reasonable changes that vendors needed for their products.  They are
trying *very* hard to get Skipjack and key escrow into lots of
products.

---

From: [email-masked] (Paul McKeever)
Date: 3 Feb 1994 16:31:09 GMT

Re: the NSA working "very hard" to get Clipper/Capstone into as many
products as possible: YOU'RE MISSING THE POINT OF THEIR EXERCISE.

Wide distribution is not as stupid as it seems: it's not meant ONLY
to catch "stupid criminals".  RATHER: it is the psychology that is
being paid for.

Specifically, Joe Lotech is going to push the "private" button on
his telephone whenever he's using, say, his cellular phone (in fact,
privacy mode will probably be the default, and Joe Lotech will
know it).  Essentially, the omnipresence of government-designed
encryption will create a false sense of security among the masses.
"Hey!  I don't have to worry about snoopy people listening in on
my cellular phone calls anymore...Cool!".

When Joe Lotech is confronted by a little lab dweeb named Johnny
Nofool, Johnny will say to Joe: "Hey, you know, that privacy mode
doesn't prevent the police from listening in on your conversation"
Joe Lotech will reply "Ah!  You're paranoid man!  Besides, I'm
sure that the cops don't give a **** if I tell my girl that I
want to have sex with her tonight!  Get real!  Relax!  When
was the last time the cops arrested YOU for talking on the phone?!
You're paranoid man."  Johnny Nofool replies: "No really, listen.
There are all kinds of reasons that you should not rely on the
privacy imparted to your phone conversations via the government's
chip.  For example, what about industrial espionage...it's not
overly hard for a government key to get into the wrong hands
you know!  Or what if you are a member of some political party
that the government is trying to eliminate...hi-tech McCarthyism
can recur you know."  Joe Lotech: "Look man.  I'm a Republican.
And I don't communicate any ideas that big business would like
to steal: I work at GM for *****'s sake!  Geez...I think you
need to get laid, or take a vacation, or something man!  AND
BESIDES, this privacy gizmo came with the phone, it's cheap, 
it does the job for me, and parts are available if it breaks
down...I think this gizmo will do me just fine.  See ya."

This conversation (or something like it) WILL occur.  You watch.

Government will make a lot of hoopla in the papers about how
cellular phones and faxes etc. are listened to all of the time.
Donohue will have testimonials of nimrods whose marriage broke
up when their wife overheard them talking to a mistress by listening
in with her scanner, etc., etc..  Then, you'll see Clinton or
Gore strutting out on the news within weeks thereafter to announce
how they are bringin the USA into the 21st century with "super
chips" or some such nonsense that will both protect American
privacy, and allow government to "crack down on crime" (part of
the crime bill? an amendment?).  Clipper will proliferate, and
will me as common as pushbuttons on telephones etc..  THE PEOPLE
WILL BE HAPPY AND SATISFIED.

In their satisfied state, the people will, in fact APPLAUD, a
move to crack down on evil criminals who are using "military"
encryption to undermine American peace, and spread terrorism.
It will be a CAKEWALK to pass the FBI's proposed Digital Telephony
Act.  Government-proof encryption will be illegal, and the penalties
for possession or use will be steep.  Other countries will follow
suit (Canada first).  The dream of perfect privacy and truly-free
communication will be dead.

These talks may be good, but I doubt much progress will come of them
(I'm referring to these talks with the NSA and FBI).  These agencies
have GENUINE concerns about criminality and national security.  I
think the real solution is going to have to come from private industry.
The private sector must make people aware of the difference between
government-proof and government-prone encryption.  But it must also
help the NSA and FBI to overcome the very real problems associated
with wide-spread, legal, government-proof encryption.  Everyone
needs to get thinking on an alternative to government-prone encryption, 
and to start educating the public before they think Clipper and Capstone
are good enough, and to start thinking of ways to prevent strong
encryption from being used for criminal purposes (perhaps the latter
is not possible?).

Just my two cents.

-- 
Paul
====
My opinions are my own and are not intended to represent the 
opinions of people or organizations that disagree with me.

---

From: [email-masked] (Stanton McCandlish)
Date: 3 Feb 1994 21:46:29 -0500

In article <[email-masked]>,
David Sternlight <[email-masked]> wrote:
>In article <[email-masked]>,
>Jim Bowery <[email-masked]> wrote:
>>
>>Who knows, maybe a few more humbling experiences like this and they'll 
>>all of a sudden remember who they are supposed to be serving and why
>>servants aren't always given full access to all aspects of their
>>masters' estates.
>
>These remarks come with ill grace. 

How so?  2 simple facts underlie his statements:

1) public servants, such as law enforcement, serve the public (us).
2) there have been many abuses of citizens (us) by such public servants.

He makes a single assertation:

3) the reason for #2 above is that public servants tend to forget who they
serve, and take advantage of their position.

I don't think that's an unreasonable presumption.

>From the start there was nothing in the
>Clipper press release saying they were going to prohibit alternate
>encryption. That was a fear raised here. 

Au contraire!

From the original White House press release [** emphasis, like this, 
added **, and interpolated notes in brackets]:

>Q:	If the Administration were unable to find a technological solution
>like the one proposed, ** would the Administration be willing to use legal
>remedies to restrict powerful encryption devices? **
>	
>A:	** This is a fundamental policy question which will be considered **
>during the broad policy review. The key escrow mechanism will provide
>Americans with an encryption product that is more secure, more convenient,
>and less expensive than others readily available today,
 [implying it is meant to replace the "others"]
> ** but it is just one piece of what must be the comprehensive approach to
> encryption technology, which the Administration is developing. **
 [more directly states that the Administration considers a "comprehensive
 approach" to crypto to be only one "which the Administration is developing.]
>	
>	The Administration is not saying, "since encryption threatens the
>public safety and effective law enforcement, we will prohibit it outright"
 [note that the negation here negates only the main clause of the quoted 
 passage, not the secondary clause.  In effect this says that the Admin. is
 not going to ban all cryptography {of course not; they are producing it
 themselves], but that it DOES consider crypto to threaten "public safety and
 ...law enforcement."]
>(as some countries have effectively done); 
 [The implication here is also clear: 'Other countries, by definition
 inferior, have banned crypto. The US govt is the most massive and powerful
 in the world, and if it wants to, it can and will ban crypto successfully.']
>** nor is the U.S. saying that "every American, as a matter of right, is
> entitled to an unbreakable commercial encryption product." **
[...]

Note the last like.  That's a key statement.

Note the turn of phase "...nor is the U.S. saying...", implying not that
a decidedly disfavoured President and his advisors are saying something, 
but that _the United States of America_, as a single united unit, is
saying something.  This is of course absurd, as is most everything in the
press release, but most people are unlikely to notice this sort of thing,
and it will effectively work a lot of psychological voodoo.

In response to later questions they
>confirmed that they had no plans to do so (within a month of the first
>discussion here) and that statement was also quoted here. 

Au contraire!

From a NIST response to a letter from PKP/RSADSI's Jim Bidzos
[Emphasis/comments as before]:

>NIST:    ** There are no current plans to legislate the use of Clipper.**
 [Sounds good.  Yet see last sentence in next section.]
>         Clipper will be a government standard, which can be - and
>         likely will be - used voluntarily by the private sector. The
>         ** option for legislation may be examined during the policy
>         review ordered by the President. **

and

>NIST:    Again, the Clipper Chip is a government standard which can
>         be used voluntarily by those in the private sector.  We also
>         point out that the President's directive on "Public
>         Encryption Management" stated: "In making this decision, I
>         do not intend to prevent the private sector from developing,
>         or the government from approving, other microcircuits or
>         algorithms that are equally effective in assuring ** both **
>         privacy ** and ** a secure key-escrow system."

Despite the double-talk and -think in the language of this and other such
documents, including the original press release, the message is clear:
There are no _current_ plans to make Clipper mandatory, but their may be
in the future (this was confirmed later in a response to questions about
Clipper, where in it was stated that banning non-Clipper crypto was an
issue that would be considered.  I cannot provide quotes from that one, as
I don't have it handy.  When I find it I will be happy to do so.) 
Furthermore, the Administration may approve encryption schemes with _both_
effective crypto _and_ key-escrow (a contradiction in terms), but very
clearly implies that it will not approve (as if it has any right to
approve or disapprove) encryption without key-escrow. 

I can give other examples, but I am hungry and tired and have 200 emails
to read, so I will leave further research as an exercise for the reader. 

>Those with
>anti-government water to carry then tried to pick apart their statement in
>that instance. Now we have yet another confirmation.

The almost-off-the-record statement of low-rank govt. representatives does
not qualify as a "confirmation" of anything.  Even the President's own
press releases on the matter don't confirm, they simply attempt to skirt
the issue with weasel words.  

>Now there's nothing wrong with being careful, or questioning the government
>closely in this matter, 

That much is true.

>and we are all indebted to those who are vigilant in
>the protection of our civil rights. 

<nod>

>But to make this the occasion of a
>sarcastic diatribe does not forward the action.

If you mean that this man's Usenet posts won't win any "wars" for us, this
is true, but I don't think it was intended to do so.  Looked like
expression of an opinion to me.  I also, personally, don't detect any
sarcasm, only irony, based on the what looks to be the reality of the
situation.

To sum up, until the Administration produces a VERY clear statement that:

1) Clipper absolutely positively will not ever be mandatory in any way for
anyone (other than, I suppose, people passing around "sensitive but not
classified" material as part of their govt. employee duties, as originally
suggested), and
 
2) Clipper is not intended to displace private sector, commercial
encryption products, and

3) that other forms of encryption, _even those with no key escrow of any
kind_, will absolutely positively never ever be prohibited, then

the only safe assumption that can be made is that 1, 2 and 3 are false,
and that we have to fight to make them true.  Any other course of action
is careless, apathetic, naive and dangerous.  Period.  The govt's feelings
won't be hurt, and they sky won't fall down, if 1, 2 and 3 actually ARE
true, and we just don't know it.  We're all in deep kim chee however if
they are false.  Better to "over react" and do no harm, than not react
fast enough, and lose a good measure of our privacy.
-- 
Stanton McCandlish * [email-masked] * Electronic Frontier Found. OnlineActivist
F O R   M O R E   I N F O,    E - M A I L    T O:     I N F O @ E F F . O R G 
O  P  E  N    P  L  A  T  F  O  R  M     O  N  L  I  N  E    R  I  G  H  T  S
V  I   R   T   U   A   L   C  U   L   T   U   R   E      C  R   Y   P   T   O