
 [...]

Maybe 300 such pairs suffice to reconstruct S1 and S2? By such a back-
door (in the encryption algorithm perhaps) it would be possible (for  
the manufacturer) to get the keys of all chips that were programmed in 
one session. This would not, btw, enable anybody else to retrieve the 
keys in the same way because they'll never get a bunch of 300 (N,U) 
pairs with identical S1 and S2. (Note that these have to be constant 
for the whole batch by the very nature of the procedure, i.e., they 
have to be typed in manually by the `random number supplying agents'!)

And I was wondering why they'll always do 300 chips in one session ... 
Since the procedure described by Ms Denning imposes high costs on the 
production of every chip (at least three persons for one hour each, 
plus the cost of a laptop finally blown to pieces in a spectacular, 
Hollywood-like bonfire; add travelling expenses, drinks and lighting, 
divide the sum by 300) there won't be a larger demand -- not from the 
private sector anyway. 

And let me mention one other thought that certainly has occurred to all 
the notoriously paranoid people in this group before: Who is going to 
verify that _no_ interested party will perform tempest attacks on the 
vault?? 

Where there's so much smoke and mirrors -- there can't be a nice, honest 
fire but something really worth hiding ... 