\documentstyle[fullpage]{article}
\title{System Design and the Clipper Chip}
\author{Greg Hudson}
\begin{document}
\maketitle

The secrecy requirements of the Clipper Chip force it to violate at
least two important system design principles: the principle of open
design, and the end-to-end principle.  Because of these violations,
the Clipper Chip is likely to become a useless component of any system
it is a part of.

The open design principle states that the design of a cryptographic
system should be public; barring that, the system should still be
viable if the secrecy of the design is compromised.  The Clipper Chip
can make no such allowances; if the design became public knowledge,
there would be nothing to prevent a manufacturer from making clipper
chips without going through the key escrow process.

Thus, Clipper will become useless for the government's purposes as
soon as someone reverse-engineers the algorithm.  Certainly, the chip
is made to be resistent to reverse engineering, but there are some
indications that it may not be resistent to destructive reverse
engineering, and reverse engineering techniques can change over time.

Moreover, because the Clipper design is not open, there is no way to
verify its security in the face of advances in cryptanalysis.  In a
few years, the only safe assumption will be that Clipper is no longer
a strong form of encryption.  Yet because of the closed design
manufacturing process, it will probably have proved too difficult to
build forward-compatible systems based on it, so it will most likely
be very difficult to replace the encryption mechanism in a
Clipper-based system.

The end-to-end principle states that aspects of data transport such as
retransmission, elimination of duplicate datagrams, and encryption
should be handled at the application layer unless there are efficiency
reasons to handle them partially at lower levels.  The Clipper Chip
clearly cannot rely on applications to encrypt their own data using
its mechanism, so it handles encryption at the link level, in
hardware.

The viability of this design depends heavily on the Clipper Chip's
interface and functionality being adequate for the purposes of all
applications.  If applications find that they have different needs for
encryption, they're out of luck.  For instance, suppose it is revealed
that it is a bad idea to send a lot of repeated, publicly known plain
texts over the Clipper-encrypted channel; a low-level interface may or
may not anticipate that the application might want to turn off
encryption for part of the message, or encrypt using a temporary
session key.

In the end, authors of applications which need secure communications
will choose to super-encrypt data before sending it through the
Clipper chip, turning the Clipper Chip into a vestigial component of
any design it is a part of.  While there may be no better way of
designing an encryption mechanism that suits the government's
purposes, the Clipper Chip's violation of the open design principle
and the end-to-end principle severely compromise its usefulness as
part of a secure computer system.

\end{document}

