11 ms·

I worry that they might sell it as a reason backdoors are necessary: if only we had backdoors, we could've saved those patients! The flaw of this logic would be

I worry that they might sell it as a reason backdoors are necessary: if only we had backdoors, we could've saved those patients! The flaw of this logic would be lost on most lawmakers.

betenoire 9y ago
Humor me... if encryption had a backdoor, then ransomware could be effectively mitigated.... Though I'm not a proponent of backdoors by any means, I don't see the logical flaw here.
- bajsejohannes 9y ago
  How would you practically do that? Send all those encrypted hard drives to NSA to be decrypted? Publish the backdoor, effectively rendering that encryption scheme broken?
  - asdfgadsfgasfdg 9y ago
    Just ask the NSA to send you the un-encrypted files - they probably have them in their database anyway.
- H1Supreme 9y ago
  Then encryption wouldn't be doing what it's set out to do.
- ajmurmann 9y ago
  So developers of ransomware would build backdoors into their ransomware because the law requires them to?
- thomnottom 9y ago
  Assuming that the criminal opts to use the encryption with an NSA backdoor and the victim is able to schedule time at their local NSA Genius Bar to recover their data.
- TehCorwiz 9y ago
  Wouldn't the attackers just use a crypto scheme that didn't have a backdoor?
- winkeltripel 9y ago
  The logic is that encryption without a backdoor already exists, and no law can stop a criminal writing a virus from using that.
- pjc50 9y ago
  Who has the keys to the backdoor? How do you force the ransomware authors not to use the good encryption?
- rickdg 9y ago
  It's either turtles all the way down (backdoor of the backdoor of the backdoor..) or you always strive for secure software.
- pwagland 9y ago
  Well, the bigger problem would be ensuring that the criminals used known broken encryption. The only advantage is that many of these attacks are copy-cat, so if you released the source code for a broken ransomware implementation, it will probably get used more or less verbatim… as has been shown in the past. (https://threatpost.com/bitcrypt-ransomware-deploying-weak-crypto/104448/ https://threatpost.com/bitcrypt-ransomware-deploying-weak-cr..., https://www.utkusen.com/blog/destroying-the-encryption-of-hidden-tear-ransomware.html https://www.utkusen.com/blog/destroying-the-encryption-of-hi...) Anyone who actually knows what they are doing, and are prepared to break the law, would just use AES. All of those law-abiding institutions would be forced to use a weak encryption scheme. Sure, it might help stop script kiddies, but it won't help to stop professionals, and professionals are the ones that you have to worry about, since they end up hosing 45,000+ installations in a day.
  - jacquesm 9y ago
    If they don't just replace your data outright with noise.
- squeaky-clean 9y ago
  > if encryption had a backdoor This is the flaw in the logic. "Encryption" can't have a backdoor any more than math can have a back door. Specific types of encryption can. But there's nothing to stop a malicious user from using a non-backdoored encryption algorithm or inventing their own.
  - kmonsen 9y ago
    Yeah, I don't think ransomware is going to use the US approved algorithm. What they are doing is already illegal.
- stevefeinstein 9y ago
  The logic is sound in theory. But in practice if the government can't protect its exploits, they mot likely can't protect their keys to the backdoor.
- merpnderp 9y ago
  Why would ransomers use encryption with a back door? It's not like you can force them to only use the crackable math.
- SimbaOnSteroids 9y ago
  Why would the people reaping the rewards of ransomware use encryption that has backdoors if backdoorless encryption already exists.
- djsumdog 9y ago
  ...Because criminals are going to use state-sanctioned encryption software with mandated backdoors? Even if everything off the shelf and open source has some built-in escrow unlocking keys compiled in, hackers are just going to find those code paths and remove them. Encryption works because of certain mathematical principals and laws. Backdoors will only let governments look at legitimately encrypted data and not anything made by criminals who know how technology works. There's a bigger question here: what if the NSA or CIA or some other intelligence/defence organisation discovers a solution to solve some of these hard problems in polynomial time .. and then doesn't release that information so they can use it to spy. In that situation you're going even further: you have agents who are literally holding back scientific research that could change the entire field of mathematics and human understanding, research that could advance number theory by orders of magnitude (a jump equal to that of going from the first flight Kitty Hawk to the Saturn 5 rocket), for limited political gain.
  - betenoire 9y ago
    That makes sense... So "If encryption had a backdoor" is meaningless. It's really "If a given encryption implementation had a back door" and no one is making the criminals use certain algorithms. thanks
- mtgx 9y ago
  Only if the bad guys use the NSA-backdoored encryption.

I worry that they might sell it as a reason backdoors are necessary: if only we had backdoors, we could've saved those patients! The flaw of this logic would be lost on most lawmakers.

betenoire 9y ago

Humor me... if encryption had a backdoor, then ransomware could be effectively mitigated.... Though I'm not a proponent of backdoors by any means, I don't see the logical flaw here.

bajsejohannes 9y ago
How would you practically do that? Send all those encrypted hard drives to NSA to be decrypted? Publish the backdoor, effectively rendering that encryption scheme broken?
- asdfgadsfgasfdg 9y ago
  Just ask the NSA to send you the un-encrypted files - they probably have them in their database anyway.
H1Supreme 9y ago
Then encryption wouldn't be doing what it's set out to do.
ajmurmann 9y ago
So developers of ransomware would build backdoors into their ransomware because the law requires them to?
thomnottom 9y ago
Assuming that the criminal opts to use the encryption with an NSA backdoor and the victim is able to schedule time at their local NSA Genius Bar to recover their data.
TehCorwiz 9y ago
Wouldn't the attackers just use a crypto scheme that didn't have a backdoor?
winkeltripel 9y ago
The logic is that encryption without a backdoor already exists, and no law can stop a criminal writing a virus from using that.
pjc50 9y ago
Who has the keys to the backdoor? How do you force the ransomware authors not to use the good encryption?
rickdg 9y ago
It's either turtles all the way down (backdoor of the backdoor of the backdoor..) or you always strive for secure software.
pwagland 9y ago
Well, the bigger problem would be ensuring that the criminals used known broken encryption. The only advantage is that many of these attacks are copy-cat, so if you released the source code for a broken ransomware implementation, it will probably get used more or less verbatim… as has been shown in the past. (https://threatpost.com/bitcrypt-ransomware-deploying-weak-crypto/104448/ https://threatpost.com/bitcrypt-ransomware-deploying-weak-cr..., https://www.utkusen.com/blog/destroying-the-encryption-of-hidden-tear-ransomware.html https://www.utkusen.com/blog/destroying-the-encryption-of-hi...) Anyone who actually knows what they are doing, and are prepared to break the law, would just use AES. All of those law-abiding institutions would be forced to use a weak encryption scheme. Sure, it might help stop script kiddies, but it won't help to stop professionals, and professionals are the ones that you have to worry about, since they end up hosing 45,000+ installations in a day.
- jacquesm 9y ago
  If they don't just replace your data outright with noise.
squeaky-clean 9y ago
> if encryption had a backdoor This is the flaw in the logic. "Encryption" can't have a backdoor any more than math can have a back door. Specific types of encryption can. But there's nothing to stop a malicious user from using a non-backdoored encryption algorithm or inventing their own.
- kmonsen 9y ago
  Yeah, I don't think ransomware is going to use the US approved algorithm. What they are doing is already illegal.
stevefeinstein 9y ago
The logic is sound in theory. But in practice if the government can't protect its exploits, they mot likely can't protect their keys to the backdoor.
merpnderp 9y ago
Why would ransomers use encryption with a back door? It's not like you can force them to only use the crackable math.
SimbaOnSteroids 9y ago
Why would the people reaping the rewards of ransomware use encryption that has backdoors if backdoorless encryption already exists.
djsumdog 9y ago
...Because criminals are going to use state-sanctioned encryption software with mandated backdoors? Even if everything off the shelf and open source has some built-in escrow unlocking keys compiled in, hackers are just going to find those code paths and remove them. Encryption works because of certain mathematical principals and laws. Backdoors will only let governments look at legitimately encrypted data and not anything made by criminals who know how technology works. There's a bigger question here: what if the NSA or CIA or some other intelligence/defence organisation discovers a solution to solve some of these hard problems in polynomial time .. and then doesn't release that information so they can use it to spy. In that situation you're going even further: you have agents who are literally holding back scientific research that could change the entire field of mathematics and human understanding, research that could advance number theory by orders of magnitude (a jump equal to that of going from the first flight Kitty Hawk to the Saturn 5 rocket), for limited political gain.
- betenoire 9y ago
  That makes sense... So "If encryption had a backdoor" is meaningless. It's really "If a given encryption implementation had a back door" and no one is making the criminals use certain algorithms. thanks
mtgx 9y ago
Only if the bad guys use the NSA-backdoored encryption.