4 ms·
Can someone explain to me how a proposed government backdoor into encryption would work? Is every creator of encryption software supposed to build in a master k
by austenallred 11y ago
Can someone explain to me how a proposed government backdoor into encryption would work? Is every creator of encryption software supposed to build in a master key and hand that over to the FBI?
I ask this in all seriousness, as I cannot fathom how such a system would be implemented, even disregarding the Constitution and the willingness of those creating the software.
- jrcii 11y agohttps://en.wikipedia.org/wiki/Key_escrow https://en.wikipedia.org/wiki/Key_escrow https://en.wikipedia.org/wiki/Secret_sharing https://en.wikipedia.org/wiki/Secret_sharing It's a terrible idea. The only proposed methods with theoretically possible security would suffer insurmountable side channel issues. Edit: more https://dspace.mit.edu/bitstream/handle/1721.1/97690/MIT-CSAIL-TR-2015-026.pdf https://dspace.mit.edu/bitstream/handle/1721.1/97690/MIT-CSA...
- austenallred 11y agoThat makes sense (technologically). Still a terrible idea but I understand how it would be done now, thanks.
- Arainach 11y agoSteven Levy wrote an excellent book about the first big battle over encryption standards in the 90s, "Crypto". One of the more heavily pushed "solutions" was the Clipper Chip, which was essentially key escrow.
- newman314 11y agoSee also TSA Master keys for a physical implementation and how well that works (or not). [1] [1] https://www.schneier.com/blog/archives/2015/09/tsa_master_keys.html https://www.schneier.com/blog/archives/2015/09/tsa_master_ke...
- coderdude 11y agoLike most insane directives I'd imagine this one isn't intended for the masses. Only for the ones you want to compel. This isn't as technical an issue as we'd want to believe. They want to be able to light a fire under your ass. Once they light that fire, the technical issues are moot.
- sandworm101 11y agoContrary to many opinions here, this is not a new problem. For many years encryption products included "work reduction" schemes. Not backdoors per se, but schemes that allowed those with the insider knowledge to bruteforce the encryption in a reasonable time. Those without the knowledge (the public) still faced strong encryption. It worked back in the 90s. With today's computing power it is likely no longer practical. Google "export grade encryption" and "lotus notes" https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#PC_era https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... Dark dark days for privacy, and it came back to bite us as the FREAK vulnerability, but those in charge today are old enough to remember such tricks. That's why generals still talk of cooperation to create reasonable backdoors, they confuse true backdoors with the old work reduction schemes.
- shmerl 11y agoIt won't work. That's about it. I.e. once there is a backdoor, security is compromised and it can be used both by law enforcement and malicious attacker.
- bigiain 11y ago"Is every creator of encryption software supposed to build in a master key and hand that over to the FBI?" Including, presumably, not only programmers who're not under the jurisdiction of the FBI, but also programmers for whom the FBI is genuinely "their and their nation's adversary"? Reminds me of a recent tweet: Homeland Security's new "House Un-American Mathematics Committee": https://twitter.com/puellavulnerata/status/67290345222221824 https://twitter.com/puellavulnerata/status/67290345222221824
- marcosdumay 11y agoI guess that's the overall idea. Also, the US will probably forbid anybody from outside their jurisdiction from creating encryption software, otherwise it won't work. \s
- jacquesm 11y agoAnd of course that is balancing on the assumption that only the US has people capable of building such software.