Schneier on Security

Clive Robinson • August 26, 2025 7:06 PM

@ Bruce,

The original driver behind weak crypto in ETSI was the French Government Agencies as I’ve mentioned before.

The idea of “compressing keys” comes from William Friedman and later the NSA in military “field ciphers” and got taken to extraordinary lengths in the design of Clipper / Capstone.

Originally the idea was to have relatively few “strong keys” and mostly “weak keys”. The keys used by allied troops were centrally issued by the NSA through administration levels to the various command levels.

Behind this was the realisation that,

Weak keys in field ciphers were back then not an issue. Because by the time they were broken the information was not just “stale” but probably known to the adversary by physical circumstances.

Further if as was very likely if a mechanical field cipher was captured by a “less sophisticated adversary”it would be used by them directly or copied with little or no change. Further the tricks in the design that made strong keys was deliberately not obvious and any changes would end up weakening all keys.

The actual realisation behind the weak key idea being that an inexperienced adversary who copies the then mechanical system would end up up by random selection using the weak keys 80% or more of the time. Thus the decrypt people would break the adversaries messages quickly.

However in addition the British had developed two separate techniques to significantly amplify these breaks to make attacking even strong keys very much easier.

Firstly they built a card index database with as much information as possible to build up “probable plaintext” as “cribs”. But this was not just based on broken messages, it was based on Traffic Analysis and similar techniques including semi/public information like “officer / promotion” lists and transfers…

Traffic analysis often gave near immediate “actionable intelligence” without having to know the plain text of the encrypted message.

At one point for the British they found other tricks became possible. For instance some “messages” like ‘weather and warning’ messages ‘to all ships’ were identical in several different cipher systems. One of the weakest of which was the “Dockyard Cipher”. Thus breaking this gave a “probable plaintext” for all the other cipher systems thus assisting in key recovery thus breaking of other much higher value ciphers.

Thus the idea of “weak keys” in the “key space” became a standard technique for SigInt agencies to inflict on others.

Involved with this was a German Company Siemens and a Dutch company Philips. Likewise two UK companies ITT and Plessey PLC and ITT Ltd as was. All involved with making fully electronic cipher systems and the chips that went inside them.

It’s known that the CIA significantly influanced Siemens and the NSA Phillips, with GCHQ influencing the British based companies. The usual trick was to “ease export licencing”…

So I would personally assume anything that comes via this sort of organisation without full and cerifiable open documentation is at best questionable.

Anything with a “French Vote” or “technical input” will from French law be hamstrung in some way as a matter of policy.

So anything from European entities such as ETSI, Cen-CenElec, GSMA, 3GPP and the new “private standards groups” for ICT are almost certainly going to have “weak key” or similar built in “for export” and that weakness can be turned on remotely almost certainly.

The big problem of course is non of the managment side will use Post-Quantum encryption and these products will have upto a half century product life at least.

But then I’ve said all of this for quite a period of time now, especially to do with “smart grids”.

But note whilst “End to End Encryption”(E2EE) can be secure…

There are certain requirements you must do first. The big one I’ve mentioned repeatedly is ensuring you get your “end points” correct.

If your “communications end point” is beyond your “encryption/privacy/security end points” then an adversary can simply do an “end run attack” around the E2EE or disable it.

Further if an adversary can run software etc on the user side beyond the endpoints then they can do user/client side scanning” of all plaintext.

To mittigate these potential vulnerabilities you need strong “segregation”.

You don’t get “strong segregation” in consumer or commercial communications equipment “by design” perhaps it’s well past time people started asking awkward questions about this…