Clipper Chip Key Escrow (Skipjack / LEAF) Announced — and Undermined by Matt Blaze's LEAF Forgery
On 16 April 1993 the White House announced the NSA-designed Clipper Chip, a voice-encryption chip whose keys would be escrowed with the government; it was adopted as FIPS 185 in February 1994, and in 1994 AT&T Bell Labs researcher Matt Blaze showed the escrow mechanism could be bypassed.
02Deep-Dive Technical Analysis
Each Clipper chip encrypted traffic with the classified 80-bit Skipjack cipher and transmitted a 128-bit Law Enforcement Access Field (LEAF) carrying the session key encrypted under the chip's unit key, the chip ID and a checksum. Unit keys were split between two government escrow agents so that a court-authorised wiretap could recover them. Blaze's 1994 paper "Protocol Failure in the Escrowed Encryption Standard" showed the LEAF checksum was only 16 bits, so a rogue device could brute-force a bogus LEAF that passed validation, retaining Skipjack confidentiality while defeating escrow.
03Vulnerability & Exploit Flow
Brute-forcing a counterfeit LEAF that satisfies the 16-bit checksum so the receiving chip accepts traffic without a valid escrowed session key.
04Recommended Defense & Mitigation Protocol
No technical fix was deployed; the policy was abandoned and the lesson (escrow protocols need strong integrity binding, and are risky by design) informed later crypto policy reviews.
05Security Impact & Geopolitical Consequence
Blaze's result became the canonical demonstration that mandated "exceptional access" adds fragile protocol attack surface; Clipper saw little adoption and was abandoned by 1996, and the episode still frames every lawful-access-to-encryption debate.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.