[14659] in Cypherpunks
Re: Faster way to deescrow Clipper
daemon@ATHENA.MIT.EDU (Perry E. Metzger)
Fri Jun 3 08:10:53 1994
To: Mike Ingle <MIKEINGLE@delphi.com>
Cc: cypherpunks@toad.com
In-Reply-To: Your message of "Thu, 02 Jun 1994 19:39:05 EDT."
<01HD2TUJI8NC95Q50V@delphi.com>
Reply-To: perry@imsi.com
Date: Fri, 03 Jun 1994 07:57:06 -0400
From: "Perry E. Metzger" <perry@imsi.com>
Mike Ingle says:
> The attack posted here uses a brute-force search to find a phony LEAF
> which has a valid checksum. Instead, why not just initialize the chip
> with a session key and get the LEAF. Reset the chip and initialize it
> with a different session key, but send the first LEAF instead of the
> second one.
An interesting idea.
> The LEAF would look good unless you tried to decrypt the
> session key. The wrong-IV problem would remain. The NSA should have
> designed the Clipper so that, if the IV was wrong, the chips would not
> accept the LEAF.
That can't be done, I'm afraid. Its way to difficult to distinguish a
bad IV from line noise nuking the first block of your CBC
conversation.
> They also should have used a much larger (32-bit or even 64-bit) checksum.
Matt suggests precisely that in his paper.
Perry
