IBM microwave applicationearly data communications 2822

ref:

one of the things that i worked on as part of HSDT

... was design a replacement encryptor .. that i could build for under $100 and that could potentially change key on every packet (with the header-address in the clear, i.e. level 2 rather than a lavel 1 link encryptor).

of course it had to operate at significantly (enormously) higher rates than the box mentioned in the attached ... from somewhere long ago and far away:

To: WHEELER at SJRLVM1

Lynn, re: your questions about the public key encryption unit

The Racal-Milgo Datacryptor III uses a AMD DES chip plus some proprietary logic for exchanging master keys using a public key approach. The master keys are then used to encrypt the working keys which are actually used for data encryption. I have run the off the shelf units at 128kb full duplex through the V.35 interfaces contained in the unit. They cost about $3,200 each, single unit price.

I have to emphasize they are link level encryptors (e.g. level 1) rather than level 2 (e.g. only the data encrypted with addressing in the clear). They won't do you much good for "session" or "file" encryption.

The public key synopsis goes something like this -

1. At install time, two 60 digit prime numbers are acquired and retained in storage. The 'seeds' are developed by a combination of an operator pressing a button to sample a clock source along with internal logic.

2. When a operator wants to move a master key online, he asks the remote end for a one-time E key (56 bits plus 8 parity bits).

3. The remote end uses the two 60 digit prime numbers (with their 120 digit product) to create a E key and a D key. They are "mathematically related to the prime numbers and to each other" to quote the Racal documentation.

4. The E key can't be used for decryption and the D key can only decrypt what has been encrypted with the E key.

5. The remote end retains the D key and sends the E key to the 'requestor'.

6. The local end generates a new master key, encrypts it with the E key he just received, and sends it to the remote end.

7. The remote end decrypts the transfer with the D key he retained, they exchange a test message for verification, and exchange a new working key.

8. The E-D pair of keys are not reused. Each exchange of a master key causes a new pair to be created. The E-D pair never leave the boxes, and can't be read out or displayed. It takes about 8 seconds for the hardware to do the decryption of the received master key using the D key previously retained.

--