4 ms·

> I disagree with the authors that we can't make a backdoor for selective access. ... However, the bigger problem is key management. That right there is why we

> I disagree with the authors that we can't make a backdoor for selective access. ... However, the bigger problem is key management. That right there is why we can't make a backdoor for _selective_ access. The Bad Guys will get the credentials to access the door, (or they'll be inside the Good Guys' organization) and they'll walk right through the door. Past experience has taught us that law enforcement and government both want backdoors to be quick and rather hassle-free to use. This -obviously- is at odds with a paranoid credential management scheme. > ...I strongly recommend against any escrow or backdoor mechanism... Instead, we should focus on penalizing refusal to allow a search and implement methods to ensure the search is honest. 1) Heh. 2) If a manufacturer ships a crypto system that _cannot_ produce plaintext on demand (and cannot be modified and field-upgraded to do so) and requires physical access and sophisticated hardware tampering to defeat, will this be considered a "refusal to allow a search"?

nickpsecurity 11y ago
Incidentally, I devised such a scheme with foreign, tamper-resustant hardware for exactly that reason. I'll post it here when Im at main PC around 10:30p tonight.
nickpsecurity 11y ago
Here you go. Two useful essays on this topic: Operating an online service with resistance to U.S. TLA's https://www.schneier.com/blog/archives/2013/10/a_court_order_i.html#c1945655 https://www.schneier.com/blog/archives/2013/10/a_court_order... Related work on securing a service like Tor against NSA-level attacker https://www.schneier.com/blog/archives/2014/09/identifying_dre.html#c6678915 https://www.schneier.com/blog/archives/2014/09/identifying_d...
- simoncion 11y ago
  > Operating an online service with resistance to U.S. TLA's https://www.schneier.com/blog/archives/2013/10/a_court_order.. https://www.schneier.com/blog/archives/2013/10/a_court_order.... The second half of this is largely hand-wavy technobabble. The first half or so of it doesn't apply to the system we're describing. > Related work on securing a service like Tor against NSA-level attacker https://www.schneier.com/blog/archives/2014/09/identifying_d.. https://www.schneier.com/blog/archives/2014/09/identifying_d.... Similar song to the first one: Oh so much of that is completely unrelated to the topic at hand (which is -to wit- design of a high-volume (think hundreds of signatures per day), very low-friction, audited code signing system that creates images signed with what is -for all intents and purposes- the same key that's used to sign the official, aboveboard builds of the software). I also notice that you didn't answer my question.
  - nickpsecurity 11y ago
    "The second half of this is largely hand-wavy technobabble. The first half or so of it doesn't apply to the system we're describing." "Similar song to the first one: Oh so much of that is completely unrelated to the topic at hand " You got a talent for dismissing without reading. If you did, you'd have guessed that I implemented the second scheme in something. That actually included signed messaging and code operating at 10Mbps wirespeed. Besides, if an 8-bit CPU can do ECC/RSA ops in 0.x-3sec, then why would you think GHz CPU's w/ HW acceleration couldn't do a few hundred signatures a day? You running your infrastructure on 4-bit CPU's handwired with TTL chips or something? "high-volume (think hundreds of signatures per day), very low-friction, audited code signing system that creates images signed with what is -for all intents and purposes- the same key that's used to sign the official, aboveboard builds of the software)." You said low-friction, high-speed, no "techno-babble," and implied it shows resistance to NSA/FBI scheming. That's impossible to answer given your constraints. "I also notice that you didn't answer my question." A non-technical, low-friction answer to that is possible. Let's revisit it. "If a manufacturer ships a crypto system that cannot_ produce plaintext on demand (and cannot be modified and field-upgraded to do so) and requires physical access and sophisticated hardware tampering to defeat, will this be considered a "refusal to allow a search"?" No law says it's illegal for private party to buy intercept proof equipment unless it's radio. There's foreign countries that don't restrict crypto. So, buying one from a foreign country is legal if it passes import approval. Using it is legal. When hit with court, one must show reason other than dodging the law that the information can't be produced to dodge obvious prosecutor argument. My prior scheme on that is resistance to attacks on personnel by organized crime or foreign spies via extortion, kidnapping, torture, etc. Easier to resist them compromising everything in permanent, stealth fashion if that's impossible at manufacturing time. So, legal to buy, a justifiable reason for it, and finally great lawyers for presentation. There you go. No guarantees, though. Our laws are subject to court interpretation. That can be good or bad for the accused.

nickpsecurity 11y ago

Incidentally, I devised such a scheme with foreign, tamper-resustant hardware for exactly that reason. I'll post it here when Im at main PC around 10:30p tonight.

nickpsecurity 11y ago

Here you go. Two useful essays on this topic: Operating an online service with resistance to U.S. TLA's https://www.schneier.com/blog/archives/2013/10/a_court_order_i.html#c1945655 https://www.schneier.com/blog/archives/2013/10/a_court_order... Related work on securing a service like Tor against NSA-level attacker https://www.schneier.com/blog/archives/2014/09/identifying_dre.html#c6678915 https://www.schneier.com/blog/archives/2014/09/identifying_d...

simoncion 11y ago
> Operating an online service with resistance to U.S. TLA's https://www.schneier.com/blog/archives/2013/10/a_court_order.. https://www.schneier.com/blog/archives/2013/10/a_court_order.... The second half of this is largely hand-wavy technobabble. The first half or so of it doesn't apply to the system we're describing. > Related work on securing a service like Tor against NSA-level attacker https://www.schneier.com/blog/archives/2014/09/identifying_d.. https://www.schneier.com/blog/archives/2014/09/identifying_d.... Similar song to the first one: Oh so much of that is completely unrelated to the topic at hand (which is -to wit- design of a high-volume (think hundreds of signatures per day), very low-friction, audited code signing system that creates images signed with what is -for all intents and purposes- the same key that's used to sign the official, aboveboard builds of the software). I also notice that you didn't answer my question.
- nickpsecurity 11y ago
  "The second half of this is largely hand-wavy technobabble. The first half or so of it doesn't apply to the system we're describing." "Similar song to the first one: Oh so much of that is completely unrelated to the topic at hand " You got a talent for dismissing without reading. If you did, you'd have guessed that I implemented the second scheme in something. That actually included signed messaging and code operating at 10Mbps wirespeed. Besides, if an 8-bit CPU can do ECC/RSA ops in 0.x-3sec, then why would you think GHz CPU's w/ HW acceleration couldn't do a few hundred signatures a day? You running your infrastructure on 4-bit CPU's handwired with TTL chips or something? "high-volume (think hundreds of signatures per day), very low-friction, audited code signing system that creates images signed with what is -for all intents and purposes- the same key that's used to sign the official, aboveboard builds of the software)." You said low-friction, high-speed, no "techno-babble," and implied it shows resistance to NSA/FBI scheming. That's impossible to answer given your constraints. "I also notice that you didn't answer my question." A non-technical, low-friction answer to that is possible. Let's revisit it. "If a manufacturer ships a crypto system that cannot_ produce plaintext on demand (and cannot be modified and field-upgraded to do so) and requires physical access and sophisticated hardware tampering to defeat, will this be considered a "refusal to allow a search"?" No law says it's illegal for private party to buy intercept proof equipment unless it's radio. There's foreign countries that don't restrict crypto. So, buying one from a foreign country is legal if it passes import approval. Using it is legal. When hit with court, one must show reason other than dodging the law that the information can't be produced to dodge obvious prosecutor argument. My prior scheme on that is resistance to attacks on personnel by organized crime or foreign spies via extortion, kidnapping, torture, etc. Easier to resist them compromising everything in permanent, stealth fashion if that's impossible at manufacturing time. So, legal to buy, a justifiable reason for it, and finally great lawyers for presentation. There you go. No guarantees, though. Our laws are subject to court interpretation. That can be good or bad for the accused.