Clipper chip

Clipper chip
Name	Clipper chip
Developer	National Security Agency
Introduced	1993
Discontinued	1996
Type	Telephone encryption device
Key feature	Key escrow via "Law Enforcement Access Field"
Related	Skipjack (cipher), Escrowed encryption

Clipper chip The Clipper chip was a 1990s United States government initiative to provide standardized telephone encryption while preserving law enforcement access through key escrow. Proposed by the National Security Agency and announced during the administration of Bill Clinton, it used the Skipjack (cipher) algorithm and a key escrow architecture intended to involve federal and state law enforcement agencies such as the Federal Bureau of Investigation and the Department of Justice. The initiative sparked debate involving civil liberties organizations, technology companies, and legislators including figures from United States Senate and United States House of Representatives committees.

Background

The initiative emerged from policy discussions following testimony before bodies like the Senate Judiciary Committee and the House Select Committee on Intelligence, and was influenced by export control debates involving Bureau of Industry and Security and treaties such as the Wassenaar Arrangement. Concerns over secure telecommunications rose after events scrutinized by 9/11 Commission predecessors and surveillance episodes tied to agencies like the Central Intelligence Agency and Defense Intelligence Agency. The prototype ecosystem involved corporate partners including AT&T, Motorola, and Toshiba as vendors explored device certification in coordination with standards bodies such as the National Institute of Standards and Technology and international groups like the International Telecommunication Union.

Design and Technical Details

Clipper used the classified Skipjack (cipher) block cipher in a mode that produced voice and data confidentiality for standards-based circuits. The device implemented a "Law Enforcement Access Field" and relied on hardware implementations akin to secure modules similar to those used in Trusted Platform Module concepts; designs were evaluated by contractors including RCA and cryptographers with ties to institutions like Massachusetts Institute of Technology and Stanford University. The key management scheme invoked public-key techniques comparable to systems described by researchers at Bell Labs and in cryptographic literature referencing work from IETF and conferences like CRYPTO (conference). Implementation details touched on export classification handled by Office of Management and Budget policies and drew scrutiny from technical reviewers at Computer Emergency Response Team communities and trade press such as Wired (magazine) and InfoWorld.

Key Escrow and Law Enforcement Access

Under the proposal, each device would generate an encrypted session key with two escrowed components deposited with escrow agents: a federal depository and a redundant state or private escroweer. The mechanism paralleled escrow concepts used in banking and telematics systems overseen by Federal Communications Commission and administrative oversight from entities like the Office of the Inspector General (United States Department of Justice). Access required presentation of legal process from bodies such as United States District Court judges or warrants issued under statutes including provisions from the Electronic Communications Privacy Act and interplay with decisions emerging from the Supreme Court of the United States. Law enforcement agencies including the Drug Enforcement Administration and the Bureau of Alcohol, Tobacco, Firearms and Explosives were cited as prospective beneficiaries of lawful decryption.

Controversy and Public Opposition

Privacy advocates such as American Civil Liberties Union and academics from Harvard University and University of California, Berkeley voiced objections, joined by technologists from MIT Media Lab, independent researchers like Phil Zimmermann of Pretty Good Privacy fame, and projects associated with Free Software Foundation. Critics argued that escrow introduced systemic vulnerabilities akin to weaknesses discussed in incidents involving Johns Hopkins University security research and weaknesses found in earlier export-controlled ciphers examined by RSA Security. Industry opposition included statements from companies such as Nokia and Intel Corporation and international reactions from entities like the European Commission and national regulators in United Kingdom, Germany, and Japan. High-profile publications including The New York Times and The Wall Street Journal covered protests, while activist networks coordinated through forums associated with Electronic Frontier Foundation and grassroots petitions cited concerns echoed by judges and commentators in Harvard Law Review.

Legislative and Policy Responses

Congressional hearings in the United States Congress involved testimony from NSA officials, civil liberties representatives, and technologists; amendments and bills debated in committees such as the Senate Armed Services Committee and House Committee on Science, Space, and Technology reflected shifting stances. Legislative instruments included discussions around export control reform led by the Department of Commerce and oversight by the Government Accountability Office, while executive branch policy was shaped by memoranda from the White House and directives influenced by advisors in the Office of Management and Budget. Internationally, responses prompted consultations at Organisation for Economic Co-operation and Development and bilateral talks with agencies in Canada and Australia.

Legacy and Impact on Cryptography

Although the initiative was effectively abandoned by the mid-1990s, its debates influenced subsequent policy and technology trajectories involving end-to-end encryption debates in products from Apple Inc., Google LLC, and Microsoft Corporation. The controversy propelled research into open cryptographic standards, stimulated work in forward secrecy adopted in Transport Layer Security protocols standardized by the IETF, and bolstered the reputation of open algorithms like those reviewed by NIST and implemented in projects hosted by communities such as Apache Software Foundation and OpenSSL. The episode shaped discourse in courts such as the United States Court of Appeals and policy studies in think tanks including RAND Corporation and Brookings Institution, and it remains a cited case in debates involving surveillance legislation like proposals examined by Congressional Research Service.

Category:Cryptography