
   >Thousands?  Tens of thousands?  Do some arithmetic, please...  Skipjack
   >has 2^80 possible keys.  Let's assume a brute-force engine like that
   >hypothesized for DES:  1 microsecond per trial, 1 million chips.  That's
   >10^12 trials per second, or about 38,000 years for 2^80 trials.  Well,
   >maybe they can get chips running at one trial per nanosecond, and build
   >a machine with 10 million chips.  Sure -- only 3.8 years for each solution.

   But there is a MUCH more pernicious problem with the scheme as
proposed.  Building a brute force machine to test 2^40 possible keys
if you have the other half from one escrow agent is EASY.  (One chip,
one test per microsecond gives you one break every two weeks, and that
break gives you all messages involving that phone.)

   The XOR scheme so that the files from one escrow agent gives you
nothing is an improvement, but notice that XORing with (truely random)
bit strings allows for an arbitrary number of escrow agents.  Using +
for XOR, SK for the escrowed key, and A and B for two random bit
strings, hand SK+A+B, SK+A, and SK+B to three escrow agents.  It is
possible to come with an encoding scheme to match any escrow pattern,
for example 3 of 4, such that fewer cooperating escrow agents gives
the cracking agency no benefit.

--

					Robert I. Eachus