Matt Blaze

Background

Matt Blaze is an American computer scientist and cryptographer whose research has spanned cryptographic systems, communications surveillance, and physical security. He earned a B.S. in computer science from Hunter College, an M.S. from Columbia University, and an M.A. and Ph.D. in computer science from Princeton University, completing his doctoral dissertation on caching in large-scale distributed file systems in 1993. From 1992 to 2003 he worked as a researcher at AT&T Bell Laboratories (later AT&T Labs Research), where he conducted much of his early cryptographic work, including development of the Cryptographic File System (CFS), an early system enabling transparent encryption of Unix file systems.

The Clipper Chip and the 1994 Key-Escrow Flaw

In the early 1990s, the U.S. government promoted the Clipper Chip, a hardware encryption device built around the classified Skipjack cipher, as part of the Escrowed Encryption Standard (EES). The scheme was designed so that every encrypted communication carried a Law Enforcement Access Field (LEAF) containing information that would allow government agencies holding escrowed keys to decrypt the communication when legally authorized. In May 1994, Blaze published a paper titled "Protocol Failure in the Escrowed Encryption Standard," demonstrating that the LEAF checksum used to validate the field was too short and could be defeated: a user could transmit a bogus LEAF that would pass the receiving Clipper device's checks while preventing government agencies from recovering the escrowed key, all while the encrypted communication itself remained intact between the two parties. The attack meant someone could use Clipper hardware for strong encryption while disabling the very escrow mechanism the government relied on for lawful access. The finding was widely covered in the press and became one of the most cited technical arguments against the viability of mandatory key escrow.

Role in the Crypto Wars

Blaze's discovery arrived during the broader "Crypto Wars" of the 1990s, in which the U.S. government sought to limit the spread of strong, unescrowed encryption on national security and law enforcement grounds, while cryptographers, civil liberties groups, and industry argued that escrow schemes were both technically flawed and a threat to privacy and security. The Clipper Chip proposal was effectively abandoned by the government by the late 1990s, and Blaze's protocol-failure paper is frequently cited by historians of cryptography policy as a key technical event that undercut confidence in the key-escrow approach. Blaze continued to publish influential cryptographic research through the 1990s, including work (with others) on estimating minimum key lengths needed for adequate commercial security against brute-force attacks.

Wiretapping and Surveillance Research

Beyond Clipper, Blaze conducted extensive research into the security of law enforcement wiretapping systems themselves, identifying vulnerabilities in the Communications Assistance for Law Enforcement Act (CALEA) wiretap architecture that could allow targets to detect or evade surveillance, or that could be exploited by unauthorized parties. He has testified before the U.S. Congress on the security implications of government surveillance and encryption policy.

Voting Machine and Election Security

Blaze became a prominent researcher in the security of electronic voting systems, studying direct-recording electronic (DRE) machines such as Diebold's AccuVote line and identifying ways that malicious software could alter vote tallies without leaving detectable evidence, given the machines' lack of voter-verifiable paper audit trails. He has testified before Congress on election infrastructure security and has been a long-running voice for stronger security standards and auditability in U.S. elections, including organizing and participating in the DEF CON Voting Village, which conducts public security testing of voting equipment.

Physical Security and Academic Career

Blaze also extended cryptographic and adversarial-analysis thinking to mechanical security. In a widely cited 2003 paper, "Rights Amplification in Master-Keyed Mechanical Locks," he described practical attacks allowing someone with access to a single master-keyed lock and its associated key to derive a working master key for an entire keying system, using only blank keys and a metal file. After leaving AT&T, Blaze joined the University of Pennsylvania as a professor of computer and information science in 2004, where he led the Distributed Systems Lab. In 2019 he moved to Georgetown University, taking a joint appointment as the McDevitt Chair of Computer Science and Law at Georgetown Law and the Department of Computer Science. He has also served on the board of the Tor Project.

Legacy

Blaze's career has been marked by a consistent method: applying rigorous, adversarial security analysis to systems that combine technology and public policy, from national cryptographic standards to voting machines, wiretap infrastructure, and physical locks. His work is frequently cited as an early and influential example of independent academic security research directly shaping government technology policy, and he remains an active commentator and expert witness on cryptography, surveillance, and election security.

Timeline

• 1993Completes Ph.D. in computer science at Princeton University; develops the Cryptographic File System (CFS) while at AT&T Bell Laboratories.
• 1994-05Publishes "Protocol Failure in the Escrowed Encryption Standard," revealing a flaw in the Clipper Chip's LEAF mechanism that could defeat government key escrow.
• 1996Co-authors a widely cited report on minimum key lengths required for adequate commercial encryption security.
• 2003Publishes "Rights Amplification in Master-Keyed Mechanical Locks," detailing practical attacks against master-keyed pin tumbler lock systems.
• 2004Joins the University of Pennsylvania as a professor of computer and information science.
• 2007-2010Publishes research identifying security vulnerabilities in CALEA-mandated law enforcement wiretapping systems.
• 2018-07Sells the crypto.com domain name, which he had registered in 1993, to the company later known as Crypto.com.
• 2019Moves to Georgetown University as the McDevitt Chair of Computer Science and Law.
• 2020-01Testifies before the U.S. House of Representatives on election infrastructure security.