November 7, 2000

Little fish, big fish, twofish: John Kelsey of Counterpane Internet

Author: JT Smith

By Julie Bresnick
NewsForge Columnist
Open Source people

I have no idea what John Kelsey is talking about. Our conversation is like a
parody. It could be a Saturday Night Live skit in which a collegiate
and Bush are paired on a science project.

John Kelsey is a security architect at Counterpane
Security, and the co-author of almost 30 papers on crypotography including the Street
paper that inspired
Jesse Vincent
's OpenCulture.Org, and the Twofish block cipher
became a finalist at the Advanced Encryption Standard Development Effort(AES).

We are discussing an article I read in the Boston Globe on how solving
Minesweeper could prove encryption to be inadequate.

I'm sure the only accurate response I can make besides "a-ha,"
"sure-sure," and "yeah, I follow," (which, of course I don't) is "wow,
is complicated stuff." But even that turns out to be inaccurate.

"It's complicated in a sense that the words are complicated,"
explains Kelsey, "but the concepts really are not." I go back and review
notes on the several minutes he dedicated to explaining the trouble
with ... what, I'm not sure. My notes are scattered with question marks
sophisticated computer terms like "NP complete," "polynomial,"
"deterministic." I copy the terms on the front of index cards and
them on my pile of vocabulary cards provided by a GRE review course.

Context indicates that it has something to do with cryptography.

The concept, he explains, is that "some problems are just a pain to
do on
a computer." Sure, sure, I can handle that. "OK, when you try to
dress it
up in math it gets harder. But then you can make some really precise
statements." Yup.

The Street Performer Protocol paper is probably the only one of
papers I can even begin to understand. The majority of his work is
about science than law. But after speaking with him further, the
deviation is
not so surprising.

In fact, law and politics are what got him into cryptography in the
first place. He was finishing up an undergraduate degree in Computer
Science at University of Missouri at Columbia. He had heard a fellow
student mention the RSA, but other than that he knew very little about
cryptography--until he saw people debating the politics of it on
He was intrigued. He jumped in. To better support his arguments he
educating himself. Finally, it was the math that sealed the deal. He

It wasn't long after that he met Bruce Schneier in a
discussion group. The first edition of Applied Cryptography had just been
published and
Kelsey, being his voracious self, discovered some typos in the book's
formulas. He sent them in an email to Schneier. Schneier began
projects out to Kelsey and eventually took him on as Counterpane's
number one.

Though his 33 years makes him among the oldest of my
Kelsey has only had one other employer since college. Before
Counterpane he
worked for the Missouri Department of Corrections.

"Sometimes we would work with inmate programmers. You had to go
into a
locked facility to work with them. It was really odd.

"It wasn't anything like I would have expected. There were some
smart people, and almost none of them denied guilt, and they were some
serious criminals -- armed robbery, murder. I would have assumed that
would be a lot less intelligent. There was one guy I remember. I've
interacted with a lot of people at cryptoconferences who have degrees
from world-class places and I don't think any of them were as smart as this

When they moved the programmers into the administration building of
prison itself, Kelsey decided it was time to move on. That's when
suggested he work for Counterpane. It's an interesting juxtaposition: first the
department of corrections, and then the cutting edge of Internet

It's this kind of juxtaposition I so enjoy. It reminds of the
thrill when I meet a hard-core intellectual with a serious Boston
And it is the kind of unlikeliness that marks more than just Kelsey's

Kelsey grew up south of Paris and northeast of Columbia,
in a
small town right outside of Mexico ... Missouri. Mexico, Missouri, is
John's father ran the county program for mentally retarded adults. The paradox isn't just that a guy as bright as John grew up in a
supported by special education,
that he went into a profession so worldly after a youth spent in a town
with a population of 3,000. It was too remote even for cable
television. There were not a lot of neighbors. Distraction, let alone technology, was

He was 14 when his mother finally responded to his pleas and
brought home a VIC20. It had few rivals for John's attention, which he
dedicated to learning BASIC. He wrote games simple enough for his
six years his junior, to play. Roughly 15 years later Kelsey is
one of
six authors of Twofish, which was
recently one of the five finalists in the AES
Development Effort conducted by the National
Institute of Standards and Technology
. The AES will
"specify a
cryptographic algorithm for use by U.S. government organizations to
sensitive (unclassified) information." The only thing in common with where he started and where he is, is that they are both extremes, nowhere to
somewhere, a regular small-town-boy-goes-big story. Small fish in a
pond to big fish in very big pond.

He had never even been on a plane until he was 22. Now he
all over, presenting papers that could influence the future of
nation's security.

Considering these credentials, an endorsement
be favorable, but Kelsey is not overly enthusiastic about the security
benefits of Open Source.

"I don't think there's anything magical about Open Source. Having
available so people can evaluate it is good for code review but in the
it only matters how many eyes are really reviewing it."

Like his boss Schneier, Kelsey believes that analyzing cryptography is complicated,
the most important thing is that it be reviewed by people who know how
Whether they are within a private organization or not is secondary.

Nevertheless, he respects the benefits of Open Source and even
hopes to
originate a project of his own. He is working with a
(that he doesn't want to commit on record) to develop a second
generation of
Yarrow, a
number generator, which he hopes the Open Source community will
have the opportunity to sink its teeth into.

He also astutely equates the paper publishing process with that of
Source code development.

"You actually feel like you're making the world an unambiguously
place. You produce information and make it freely available. You
actually get paid but your reputation is enhanced."

Sounds like he does, after all, speak a familiar language.


  • Linux
Click Here!