2 ms·
Crypto is too easy. Yes, too easy. Its too easy to make a single master key for a government to demand or someone to steal that unlocks everything. In 1915 w
by VLM 11y ago
Crypto is too easy. Yes, too easy. Its too easy to make a single master key for a government to demand or someone to steal that unlocks everything.
In 1915 when a discovery subpoena goes out for all records relating to dumping dioxanes in a river, the company legitimately unlocks the filing cabinet and hands the files over. They don't get a key to the executive washroom or the telegram private code directory (unless that was in the subpoena) or the complete customer list or really pretty much anything but the paper files relating to dumping dioxanes in the river.
In 2015 when a discovery subpoena goes out for all records relating to dumping dioxanes in a river, the company freaks out because if they hand out "the" public key then both the .gov and any .com they're affiliated with and probably individual theives will pown every VPN they ever had and ever will, and all their records of every sort so "oh no we can't hand over keys never to no one".
When you look at it from that point of view, the abject failure of IT and IT companies to properly handle encryption is by no means any reason for the judicial legal system to be inconvenienced. In 1915 no judge would have tolerated a response like "Well we can't give you the dioxane pollution paper files and telegrams because then criminals would pown our company because we're incompetent at IT"
The other part is sociological. You may hold that phone in your hand, but its not yours, and using it is as dangerous as talking to a police officer or government official or hacker. Its not your phone, never has been, and any illusion to the contrary will result in tears. Ditto a site on the internet. Government protection of privacy assumes the privacy ever existed in the first place, which it doesn't.
- jeff_marshall 11y agoThe existance of "the" key is not an inherent problem in situations like this. Instead, it speaks to poor key management practices by the people responsible for implementing cryptography for an organization. Consider, as an analogy, the (poor) practice of using shared passwords. What do you do when you fire someone who had legitimate access to this password? You have to change everything or risk a compromise of all the systems sharing this password. Hence, the need for tools like sudo that separate authentication (what password / auth key) and access control (what rights). With encryption, it's similarly possible to break one big risk domain into lots of smaller ones using things like separate trust anchors (for authentication) or encryption keys (for access control). For example, If your org gets served a subpeona for your financial records you can give them your tape backups for the relevant time periods plus the necessary decryption key, but withold the decryption key for the backups of your R&D data and the signing key for your VPN.