3 ms·

Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if

Thought experiment: What if there were an encryption system whereby if a user inputs one decryption key, the encrypted data decrypts to one set of values and if the user uses a second key, it decrypts to a second set of values. Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay for protection against self incrimination from our ever growing police and surveillance state. The end of the article captures why this idea would be so effective, viz. "The authorities, however, said no testimony was needed from Rawls. Rather, they said, 'he can keep his passwords to himself' and 'produce his computer and hard drives in an unencrypted state.'" It is absolutely true and valid that the government has the right to compel people to hand over evidence that they are KNOWN to possess (in the same way that legal discovery is essential to civil cases). The line the government is drawing between self-incrimination and forced cooperation in an investigation is they they don't want him to tell them the password or what is on the drives -- they simply want him to hand over the drives in an intelligible state. Thus, if one could decrypt the drives to an intelligible set of data but not the data they desire, then you would be complying with the court order and could not be held in contempt. Can someone on HN who knows more about cryptography help poke holes in my idea?

mifreewil 10y ago
This is possible, at least in some contexts. I'm no expert, but the bitcoin wallet, Trezor, has implemented this - known as "plausible deniability". The idea is if you are compelled somehow by force to unlock your bitcoin wallet, you can use a secondary password that assumingly has less bitcoin than your regular bitcoin wallet. https://news.bitcoin.com/bitcoin-wallet-plausible-deniability/ https://news.bitcoin.com/bitcoin-wallet-plausible-deniabilit...
tedunangst 10y ago
They also have a set of hashes of files they expect to find. If they don't find those files, they'll probably ask more questions.
- kbart 10y ago
  How can they be sure that files weren't deleted?
  - tedunangst 10y ago
    You want to outsmart the cops, be my guest.
kbart 10y ago
You can't get two different sets of cleartext from the same ciphertext (except collisions, which is impractical and can be excluded for practical purposes). Of course, you can store few sets of ciphertext and decrypt depending on provided key/password, but watching disk IO may reveal that parts of disk are getting skipped. Basically, it all boils down to the competency level of the examiner.
- lsaferite 10y ago
  Well, having an encrypted storage that uses interleaved blocks for storage would allow you to have multiple versions of the data at the cost of 2x (or #x) the data storage of the largest partition. You could even throw in some parity to make the image resilient to damage. Software could then use the key provided to find the set of blocks it opens. Software wouldn't need to know anything beyond the basics of block size and number of parity blocks after it was created. Each read/write would read all the parallel blocks at once and write them all at once. All watching that would do is let you know which blocks changed. And that is assuming you can observe usage beforehand. If not, then you have no idea how many real data partitions there are or if you were given a bogus password. That being the idea behind plausible deniability.
tonyedgecombe 10y ago
Encrypted data should be indistinguishable from random, so if you had an encryption system that randomised the unused portion of your disk nobody except yourself would know whether there was data there or not.
breakingcups 10y ago
I think this is wat TrueCrypt does (did).
- ryan_j_naughton 10y ago
  Interesting. Quick wikipedia searches lead to: https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/TrueCrypt#Plausible_deniability https://en.wikipedia.org/wiki/TrueCrypt#Plausible_deniabilit...
pricechild 10y ago
Truecrypt has hidden volumes. There's also https://en.wikipedia.org/wiki/Rubberhose_(file_system) https://en.wikipedia.org/wiki/Rubberhose_(file_system) and others: https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption Same general principle, you allegedly can't prove the hidden volumes exist unless you have the decryption key.
harryh 10y ago
Thought experiment: What if you kept two sets of bank records for your business. One set of bank records were truthful and demonstrated your guilt. The others were falsified and demonstrated your innocence. What would happen if, after your bank records were subpoenaed, you hand over the falsified records? Well, you'd be committing a crime. Maybe you get away with it, or maybe law enforcement figures it out and you get caught. Depends on how clever of a criminal you are. Same thing here with your double-plaintext encryption.
- _archon_ 10y ago
  Hmm... I believe there may be a distinction here. Decrypting to the false virtual contents would be more like presenting a copy of the bank records that were correct, but the file had been corrupted and the data was unusable. However, the corrupted but true records had been created before the subpoena (not trying to obstruct) and were handed over in good faith. You wanted the contents of this drive? Here they are! The owner of the drive is definitely in a legal and moral grey area, but it would be supremely difficult to prove mens rea in this case. Interesting thought experiment: What happens when someone fills a hard drive with junk data and then encrypts it, then gets subpoena'd for the unencrypted contents of the drive?
  - harryh 10y ago
    The scenario you describe is not at all like the situation at hand. Data corruption and encryption are not the same thing as encryption is a fully reversible process. Further, the owner of the drive is not in a legal or moral grey area. They are in a "black" area where it's quite clear that they are being intentionally deceptive in defiance of a court order.
mindslight 10y ago
> Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay You moved on from this aspect too quick. The "price being paid" isn't the economic cost of more storage space, but the technical fact that your ciphertext is clearly capable of containing more information, and therefore probably does. This is a fundamental constraint of steganography. The general answer to this is to align the size of the ciphertext with some larger more-fixed volume size that has another plausible reason for existing. With Truecrypt you could say "I created a 1GiB volume as a nice round number for future storage, even though I only ever stored 100MB on there". With a general steganographic filesystem you could say "I bought a 4TB disk even though I didn't put much on there", etc. But note these arguments are only suggestive and not open-and-shut. If one has a data-hoarder amount of hard drives but only reveals enough data on them to fill up a decade-old single drive, they aren't going to be believed.

mifreewil 10y ago

This is possible, at least in some contexts. I'm no expert, but the bitcoin wallet, Trezor, has implemented this - known as "plausible deniability". The idea is if you are compelled somehow by force to unlock your bitcoin wallet, you can use a secondary password that assumingly has less bitcoin than your regular bitcoin wallet. https://news.bitcoin.com/bitcoin-wallet-plausible-deniability/ https://news.bitcoin.com/bitcoin-wallet-plausible-deniabilit...

tedunangst 10y ago

They also have a set of hashes of files they expect to find. If they don't find those files, they'll probably ask more questions.

kbart 10y ago
How can they be sure that files weren't deleted?
- tedunangst 10y ago
  You want to outsmart the cops, be my guest.

kbart 10y ago

You can't get two different sets of cleartext from the same ciphertext (except collisions, which is impractical and can be excluded for practical purposes). Of course, you can store few sets of ciphertext and decrypt depending on provided key/password, but watching disk IO may reveal that parts of disk are getting skipped. Basically, it all boils down to the competency level of the examiner.

lsaferite 10y ago
Well, having an encrypted storage that uses interleaved blocks for storage would allow you to have multiple versions of the data at the cost of 2x (or #x) the data storage of the largest partition. You could even throw in some parity to make the image resilient to damage. Software could then use the key provided to find the set of blocks it opens. Software wouldn't need to know anything beyond the basics of block size and number of parity blocks after it was created. Each read/write would read all the parallel blocks at once and write them all at once. All watching that would do is let you know which blocks changed. And that is assuming you can observe usage beforehand. If not, then you have no idea how many real data partitions there are or if you were given a bogus password. That being the idea behind plausible deniability.

tonyedgecombe 10y ago

Encrypted data should be indistinguishable from random, so if you had an encryption system that randomised the unused portion of your disk nobody except yourself would know whether there was data there or not.

breakingcups 10y ago

I think this is wat TrueCrypt does (did).

ryan_j_naughton 10y ago
Interesting. Quick wikipedia searches lead to: https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/TrueCrypt#Plausible_deniability https://en.wikipedia.org/wiki/TrueCrypt#Plausible_deniabilit...

pricechild 10y ago

Truecrypt has hidden volumes. There's also https://en.wikipedia.org/wiki/Rubberhose_(file_system) https://en.wikipedia.org/wiki/Rubberhose_(file_system) and others: https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption Same general principle, you allegedly can't prove the hidden volumes exist unless you have the decryption key.

harryh 10y ago

Thought experiment: What if you kept two sets of bank records for your business. One set of bank records were truthful and demonstrated your guilt. The others were falsified and demonstrated your innocence. What would happen if, after your bank records were subpoenaed, you hand over the falsified records? Well, you'd be committing a crime. Maybe you get away with it, or maybe law enforcement figures it out and you get caught. Depends on how clever of a criminal you are. Same thing here with your double-plaintext encryption.

_archon_ 10y ago
Hmm... I believe there may be a distinction here. Decrypting to the false virtual contents would be more like presenting a copy of the bank records that were correct, but the file had been corrupted and the data was unusable. However, the corrupted but true records had been created before the subpoena (not trying to obstruct) and were handed over in good faith. You wanted the contents of this drive? Here they are! The owner of the drive is definitely in a legal and moral grey area, but it would be supremely difficult to prove mens rea in this case. Interesting thought experiment: What happens when someone fills a hard drive with junk data and then encrypts it, then gets subpoena'd for the unencrypted contents of the drive?
- harryh 10y ago
  The scenario you describe is not at all like the situation at hand. Data corruption and encryption are not the same thing as encryption is a fully reversible process. Further, the owner of the drive is not in a legal or moral grey area. They are in a "black" area where it's quite clear that they are being intentionally deceptive in defiance of a court order.

mindslight 10y ago

> Sure, in order to encode both sets of data into a single encrypted result would require more storage space, but that is a small price to pay You moved on from this aspect too quick. The "price being paid" isn't the economic cost of more storage space, but the technical fact that your ciphertext is clearly capable of containing more information, and therefore probably does. This is a fundamental constraint of steganography. The general answer to this is to align the size of the ciphertext with some larger more-fixed volume size that has another plausible reason for existing. With Truecrypt you could say "I created a 1GiB volume as a nice round number for future storage, even though I only ever stored 100MB on there". With a general steganographic filesystem you could say "I bought a 4TB disk even though I didn't put much on there", etc. But note these arguments are only suggestive and not open-and-shut. If one has a data-hoarder amount of hard drives but only reveals enough data on them to fill up a decade-old single drive, they aren't going to be believed.