I was annoyed to find that this guy posted my private e-mail response to
him, but since I believe what I said, I'll defend it anyway.



By "almost" I mean the differential cryptanalysis attack.  The chosen
plaintext attack requires a detailed analysis of about 2^36 chosen plaintexts
drawn from a total of about 2^47 that need to be run, if I understand the
situation correctly.  This is certainly a "break" under the meaning of the
Act, but does not constitute much less work than the brute force keysearch.

The rest of his article assumes that we can figure out the Skipjack
encryption algorithm E by choosing the correct data to send through it and
observe the results.  I wish him joy of it, and choose not to try that attack.

I am not defending the system, and in fact am offended by the ideas of
escrowed keys or a secret algorithm becoming a de facto industry standard.
However, I also object to opposing it for the wrong reasons, since that
weakens the case against it.

I said (in my private e-mail):

No, it's quite different.  The government would have no percentage in
choosing F to be a weak key, since it's not to their advantage to have
anybody else know it.  The "experts" could thus assume that F is no worse
than anything else during their analysis.  Totally different situation
from unknown S-boxes.  Again, I'm not saying it would be good or
satisfactory for the experts to just be given the raw algorithm without
the rest of the surrounding details regarding the chip and protocols and
so on -- simply that I doubt that they <would> be given all the
information.