Subject: SEA's Clipper Comment

From: [email-masked] (Clay Shirky)
Date: 1 Oct 1993 21:39:54 -0400

To:						September 28, 1993
 
Director, Computer Systems Laboratory
ATTN: Proposed FIPS for Escrowed Encryption Standard
Technology Building, Room B-154
National Institute of Standards and Technology
Gaithersburg, MD 20899
 
~From:
 
The Society for Electronic Access
P.O. Box 3131
Church Street Station
New York, New York 10008-3131
Voice telephone: (212) 592-3801
Internet e-mail: [email-masked]

The Society for Electronic Access's response to the call for Public
Comment contained in:
 
FEDERAL REGISTER
VOL. 58, No. 145
DEPARTMENT OF COMMERCE (DOC)
National Institute of Standards and Technology (NIST)
 
Docket No. 930659-3159
RIN 0693-AB19
 
A Proposed Federal Information Processing Standard
for an Escrowed Encryption Standard (EES)  58 FR 40791

The Society for Electronic Access would like to register its concern
with the proposed implementation of the Clipper Chip/Skipjack
Algorithm key escrow scheme. These related protocols will be referred
to as a group as "Clipper" in the body of this letter. While we do not
object to classification of Federal Information Processing Standards
(FIPS) for encrypting information vital to national security, we
believe that a system for transfering sensitive but unclassified
information used by civilian Government offices, corporations and
private citizens should be open to public review.
 
NIST, by calling for public comment, would seem to be inviting just
such a review. However, NIST will not let the public examine either
the Clipper Chip or the Skipjack algorithm, has not commissioned
studies concerning either the cost or impact of the Clipper plan, and
will not let the public examine studies undertaken by the NSA on the
issue of escrow agency security. Furthermore, since an escrow scheme
requires a trusted third party while in the proposed scheme NIST
itself is one of the key holders, we feel that NIST will not be able
to review public comment as a disinterested party. Under these
circumstances we feel a call for public comment is hampered.
 
Our concerns with Clipper fall into four broad categories: it is
unecessary; the present Administration has promoted its "voluntary"
use by the public without abjuring the possibility of outlawing
competing systems; the key escrow scheme is not a true escrow; and
attempts to gather information necessary for a public assessment of
Clipper have met obstacles raised by the Government. These concerns
are enumerated below.
 
1) Clipper is unnecessary.
 
Clipper is not a response to any public need. In a reply to questions
about Clipper from RSA, NIST states that "[the decisions made about
Clipper] offer a balance among the various needs of corporations and
citizens for improved security and privacy and of the law enforcement
community for continued legal access to the communications of
criminals."
 
Corporations and citizens can already obtain "improved security and
privacy" from a wide variety of sources, as there are several
commercially available encryption standards currently on the market.
Since the public already has what NIST says it needs, it follows that
the only reason for Clipper to exist is the addition of the Law
Enforcement Access Field (LEAF), which allows the government to
decrypt all messages encrypted by Clipper. Furthermore, the phrase
"legal access to the communications of criminals" is particularly
chilling, as it demonstrates a lack of sensitivity to the rule of law.
Neither the FBI nor any other agency entrusted with surveillance
activities can determine in advance of a trial whether a citizen is a
criminal or not. We believe NIST's attitude belies a misunderstanding
of the rights of American citizens.
 
2) The Administration has promoted its "voluntary" use by the public
without abjuring the possibility of outlawing competing systems.
 
NIST has consistently maintained that outside Federal use, adoption of
Clipper by citizens and individuals will be strictly voluntary. When
pressed on this point by RSA, NIST responded "There are no current
plans to legislate the use of Clipper. Clipper will be a government
standard, which can be - and likely will be - used voluntarily by the
private sector. The option for legislation may be examined during the
policy review ordered by the President." We are concerned that asking
for public approval of Clipper as one of several encryption
possibilities open to the public while the possibility of outlawing
all other options still exists will prevent legitimate assessment of
Clipper's ultimate impact.
 
Furthermore, many organizations from small companies to multi-national
corporations have invested in alternative encryption schemes like RSA,
Diffie-Hellman and IDEA, many of them based solely on software and
therefore incompatible with Clipper even as a retro-fit. To outlaw
these schemes would cause them an enormous fiscal burden, as well as
mandating a US-only standard incompatible with the protocols chosen by
many international standard-setting organizations, thereby reducing
the competitiveness of US companies doing business in the
international arena.
 
We feel that unless the present administration publicly abjures the
possibility of banning alternate methods of encryption, no true
analysis of Clipper is possible.
 
3) The escrow scheme does not use true escrow agencies.
 
This scheme has been publicly promoted as an escrow scheme, but the
core of any functioning escrow scheme is the prescence of a trusted
third party (or in this case two trusted third parties.) We are
concerned with the idea that  Governmental agencies will hold these
positions, as they are not truly third parties. In addition, we are
particularly concerned that the same agency is responsible for
reviewing Public Comment on the proposed encyrption scheme and
occupying the position of one of the two key holders. We are not
convinced that NIST can fulfill both roles without conflict of
interest.
 
4) Attempts to gain information necessary for public review of Clipper
have met obstacles raised by the Government.
 
The National Security Agency has asked for an increased period of time
to respond to FOIA requests for information about Clipper, from 10
business days to one year. Ten business days falls within the Public
Comment period. One year does not. We feel that if NSA requires this
period of time to comply with requests for information that the period
for public analysis and comment should also be extended for an equal
period of time.
 
Based on these concerns, the Society for Electronic Access feels that
NIST should not implement the Clipper plan without comissioning
studies on the cost and impact of implementing Clipper, without
providing real assurances that Clipper is not a prelude to outlawing
other encryption schemes, without an implementation of an escrow
scheme in which NIST does not both review and participate in the proposal,
and without NSA complying with FOIA requests outstanding from before
September 28, 1993.
 
Respectfully submitted,

 
Clay Shirky
Board Member,
Society for Electronic Access