strnlght@netcom.com (David Sternlight) writes: > >>What follows is my opinion. It is not asserted to be "the truth" so no >>flames, please.  It comes out of a background of 20 years as a senior >>corporate staff executive in two Fortune 50 companies. > >>I'd be happy to use a crypto system supplied by the NSA for business, if >>they told me it was more secure than DES, and in particular resistant to >>attempts by Japanese, French, and other competitive companies and >>governments to break. > >>I'd be happy to do so even with escrowed keys, provided I was happy about >>the bona fides of the escrow agencies (the Federal Reserve would certainly >>satisfy me, as would something set up by one of the big 8 accounting firms).      I don't doubt that this will be the attitude of many corporate leaders. It's understandable--most corporate execs don't know much about cryptology, and it's easy to get taken in by someone peddling snake oil.  And, the proposed scheme *is* a major improvement in telephone security to what exists now.      The problem is that, with any security scheme of this kind, you have to concern yourself with the weakest link in the chain.  I suspect that NSA has put a fairly strong encryption algorithm in this wiretap chip of theirs, probably at least as strong as (say) DES in OFB-mode.  Unfortunately, the existence of the key-registry system seems to make possible all kinds of possible attacks at a small fraction of the expense of trying to build (say) a DES keysearch machine.      As originally described, it sounded like any police / court combination could acquire the key for a given chip.  I hope that's not the case, since it would imply a glaring hole.  (How much does it cost to find *one* crooked jodge and *one* crooked cop?  Especially for a foreign intelligence agency or organized crime boss?)  However, even if more intelligent schemes are used to allow access to the unencrypted phone conversations, there will be weak- nesses.  They may be very expensive, and very difficult.  But who would trust his/her confidential information to an encryption scheme that, for (say) $100,000 could by cracked one time in a hundred?  (DES, for all the complaints about a 56-bit key, would probably cost several million dollars to build a keysearch machine for.)      How many million dollars would the confidential phone messages of the GM headquarters be worth to Nissan, Chrysler, or Audi?  How about home phones of major execs and important engineers and designers? "Gee, Mr Jones, I understand you've had some financial problems lately. Maybe I can help..."   >>I'd trust something from the NSA long before I'd trust something from some >>Swiss or anybody Japanese.      Indeed, if NSA really designed the algorithm to be secure, it's very likely as secure as IDEA or 2-key DES.  However, the system as a whole isn't resistant to "practical cryptanalysis."  In _The Puzzle Palace_, Bamford describes how several NSA employees were turned by foreign (presumably KGB) agents, despite security measures that I doubt any Big 8 accounting firm could match.  And NSA confidential data was *not* subject to being requested by thousands of police organizations and courts across the land.