Subject: Who says the Clipper issue is complicated?

From: "D. J. Bernstein" <[email-masked]>
Date: Tue, 15 Feb 1994 01:13:48 -0800

``I would like to caution people about signing the petition,'' Dorothy
Denning said. ``The issues are extremely complex and difficult.''%1

Clipper (by which I mean EES/Skipjack/Clipper/Capstone collectively)
does raise some mildly tricky issues, which I'll discuss later. But 
those are _side_ issues. The basic argument%2 against Clipper is simple
and deserves emphasis.

Clipper is bad because it is unfair competition in the crypto market.

Who has paid for the design and implementation of Clipper over the past
decade?%3 The taxpayers. Who has paid for ramping up Clipper production
at Mykotronx? The taxpayers. Who pays for the lawyers and accountants
keeping Clipper on course, and the NSA-FBI team which visits Bell Labs
and other locations to promote Clipper? The taxpayers. Who will pay for
the key escrow ``service,'' probably an agency with dozens of people,
including armed guards? The taxpayers.

I resent being forced to pay for Clipper's development and adoption.

Is this Clipper subsidy the only way that the government is interfering
in the market? Not at all. Consider, for example, export controls. A
private company, even if it doesn't see a foreign market for its
encryption products, has to register as an arms dealer and take
precautions to avoid selling crypto to non-citizens. These restrictions
have been dramatically reduced for Clipper.%4

Are these points a matter of dispute? Is this just my view? No. The
government knows full well that Clipper is unfair competition.

In fact, unfair competition is the goal of Clipper policy. According to
Jerry Berman, ``the reason [for various Clipper-related actions] was
stated bluntly at the [4 Feb 94 White House] briefing: to frustrate
competition with Clipper by other powerful encryption schemes by making
them difficult to market, and to "prevent" strong encryption from
leaving the country...''%5

Now, here's the problem: The government talks about Clipper's market
interference as a _good_ thing.

Of course, I see it as a bad thing. America's need for data protection
would be fully served by a healthy encryption industry; let's eliminate
crypto export controls! If you agree with me---if you want a free crypto
market---then you should oppose Clipper. There's nothing complicated
about this.

Let me close by briefly addressing a few side issues, mostly reasons
that Clipper is risky when compared to other crypto available today.

1. There is a RISK that the Skipjack algorithm is, intentionally or
unintentionally, weak. Suppose that in 1986 an NSA cryptanalyst noticed 
a subtle but wide hole in Skipjack, which was relatively new at the 
time. Why would it be in NSA's interest to divulge this information?
Denning points out that we don't _know_ of any holes, but that's
axiomatic---Clipper would be dead otherwise. One cannot deny the _risk_,
exacerbated by secrecy, of a hole.

2. There is a RISK that Clipper will be easier to break than the basic
Skipjack algorithm. Given two encryption algorithms one can (carefully)
compose them to produce a ``double encryption'' which is strong even if
one of the algorithms is weak. Clipper also has two encryption steps,
but for a different reason---one encryption is transparent to the user,
the other transparent to the FBI. If either of these different%6 steps
is weak then Clipper is weak. ``Half encryption,'' I'd say.

3. There is a RISK that key escrow security will be compromised, either
by bribes from the outside or by corruption from the top. It is highly
dangerous to keep so many keys under the control of such a small group 
of people.

4. There is a RISK that, if Clipper fails to dominate the market, the
government will simply outlaw all non-escrowed encryption. ``This is a
fundamental policy question which will be considered during the broad
policy review.''%7 Alternatively the government could outlaw Clipper
superencryption while requiring Clipper in government procurements, new
phones, and so on. Denning points out that Clipper is voluntary right
now, but the mere fact that the government brought up the possibility
of a Clipper law means that there's a risk.

Footnotes:

%1  To sign the CPSR Clipper petition, send a message to the address
[email-masked] with "I oppose Clipper" in the subject header.
%2  This argument was mentioned briefly by Geoff Kuenning, RISKS-15.50,
among a cast of thousands.
%3  See Matt Blaze's message in RISKS-15.48. ``They said ... that
Skipjack began development "~about 10 years ago.~"''
%4  See ftp.eff.org:pub/EFF/Policy/Crypto/harris_export.statement:
``After initial review, key-escrow encryption products may now be
exported to most end users. Additionally, key-escrow products will
qualify for special licensing arrangements.''
%5  See ftp.eff.org:pub/EFF/Policy/Crypto/wh_crypto.eff.
%6  See Roy M. Silvernail's message in RISKS-15.52.
%7  See the initial White House Clipper press release, 930416.

---Dan