6 ms·

But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided? Answer: you can’t.

unabst 9y ago
That's not the point. Like a body buried in the desert, there is nothing that can force a person to reveal anything. Silence is encryption enough when it comes to secrets. Torture doesn't work either. So it's business as usual. It's obstruction of justice. Book'em. And of course, "I can't remember" is always the greatest defense. This whole thing is about the government endangering the public in exchange for abusing their rights. It's all bad. You could go as far as argue that the government is obstructing justice and endangering the public by denying basic security. We already know the enemy will find ways to access all the data. Encryption is not the last line of defense. It's the only line.
- AstralStorm 9y ago
  Can't remember is a statement that can be disproven. Pleading non self incrimination laws (as per Miranda) is more effective. Even if you have nothing incriminating. This is what DoJ wants to close by making just possession of encrypted documents criminal. (Note: not a lawyer.)
  - garblegarble 9y ago
    >Can't remember is a statement that can be disproven It is? I'm not sure how you'd disprove it. Anecdotally (which I suppose actually matters in this case!) I've had a case where a (fairly long, 26 character) password I used regularly suddenly (and thus far, permanently!) went out of my head. I can remember some fragments of the password but not the whole thing.
    - AstralStorm 9y ago
      If the prosecution has evidence you have recently logged in it will be all upto whether the jury believes you.
    - jasomill 9y ago
      I'd say the point is that the idea that the legal system suddenly has no way to deal with witnesses claiming forgetfulness "because encryption" is absurd. The only novel issues encryption brings to the table involve self incrimination, because, AFAIK, IANAL, etc., the only time an encryption key is inarguably protected by the fifth amendment is where the fact that the defendant knows the key is itself incriminating evidence, because the fifth amendment only applies to self-incriminating testimony, not other self-incriminating evidence in the defendant's possession (e.g., the contents of a hard drive, encrypted or not).
DropbearRob 9y ago
my first though as to how you would do this, is that you would implement some kind of key bag. You don't ever own your own private keys, theres a copy of them held in a central repository. they are all centrally stored and can be requested by a warrant. The problem with this of course is that its a truly horrible idea which defeats the whole concept of a private key. Another massive problem here is that you've just created the biggest target for hackers. once the keys are out... everyone is screwed.
saas_co_de 9y ago
> Answer: you can’t. No, it is incredibly simple. You have a master key and the government holds this key on a secure audited system which can only be used to unlock a device once a court order is granted. The government's security for the master key will certainly be much better than the average user's password security so this will not decrease the average user's security in the least. You would also make the master keys expire regularly (maybe daily) so as long as a user updates their phone they will get updated with the new keys to protect against a leaked key.
- ditn 9y ago
  "incredibly simple"
- sametmax 9y ago
  If you want all the investigators to be able to open things with the master keys without compromising it, it's not simple at all.
- Daycrawler 9y ago
  This is called a key escrow, which is known for not working, mainly because the assumptions ("once a court order is granted") can't be implemented technically.
  - saas_co_de 9y ago
    > known for not working care to provide any evidence for that claim? > ("once a court order is granted") can't be implemented technically we live in the real world. if you can't trust your judiciary then your precious little algorithms aren't going to save you. (sorry to be the bearer of bad news)
    - deleted 9y ago
      [deleted]
- Aaargh20318 9y ago
  > The government's security for the master key will certainly be much better than the average user's password security so this will not decrease the average user's security in the least. Yes it will. A single user being careless with their password only exposes that user. Leaking the master key (and it will leak) exposes everyone. The target is much bigger, the payoff is much bigger for the bad guys, the risks are immense.
0xfeba 9y ago
Dual-key encryption. You just have to trust the government not to lose their key.

unabst 9y ago

That's not the point. Like a body buried in the desert, there is nothing that can force a person to reveal anything. Silence is encryption enough when it comes to secrets. Torture doesn't work either. So it's business as usual. It's obstruction of justice. Book'em. And of course, "I can't remember" is always the greatest defense. This whole thing is about the government endangering the public in exchange for abusing their rights. It's all bad. You could go as far as argue that the government is obstructing justice and endangering the public by denying basic security. We already know the enemy will find ways to access all the data. Encryption is not the last line of defense. It's the only line.

AstralStorm 9y ago
Can't remember is a statement that can be disproven. Pleading non self incrimination laws (as per Miranda) is more effective. Even if you have nothing incriminating. This is what DoJ wants to close by making just possession of encrypted documents criminal. (Note: not a lawyer.)
- garblegarble 9y ago
  >Can't remember is a statement that can be disproven It is? I'm not sure how you'd disprove it. Anecdotally (which I suppose actually matters in this case!) I've had a case where a (fairly long, 26 character) password I used regularly suddenly (and thus far, permanently!) went out of my head. I can remember some fragments of the password but not the whole thing.
  - AstralStorm 9y ago
    If the prosecution has evidence you have recently logged in it will be all upto whether the jury believes you.
  - jasomill 9y ago
    I'd say the point is that the idea that the legal system suddenly has no way to deal with witnesses claiming forgetfulness "because encryption" is absurd. The only novel issues encryption brings to the table involve self incrimination, because, AFAIK, IANAL, etc., the only time an encryption key is inarguably protected by the fifth amendment is where the fact that the defendant knows the key is itself incriminating evidence, because the fifth amendment only applies to self-incriminating testimony, not other self-incriminating evidence in the defendant's possession (e.g., the contents of a hard drive, encrypted or not).

DropbearRob 9y ago

my first though as to how you would do this, is that you would implement some kind of key bag. You don't ever own your own private keys, theres a copy of them held in a central repository. they are all centrally stored and can be requested by a warrant. The problem with this of course is that its a truly horrible idea which defeats the whole concept of a private key. Another massive problem here is that you've just created the biggest target for hackers. once the keys are out... everyone is screwed.

saas_co_de 9y ago

> Answer: you can’t. No, it is incredibly simple. You have a master key and the government holds this key on a secure audited system which can only be used to unlock a device once a court order is granted. The government's security for the master key will certainly be much better than the average user's password security so this will not decrease the average user's security in the least. You would also make the master keys expire regularly (maybe daily) so as long as a user updates their phone they will get updated with the new keys to protect against a leaked key.

ditn 9y ago
"incredibly simple"
sametmax 9y ago
If you want all the investigators to be able to open things with the master keys without compromising it, it's not simple at all.
Daycrawler 9y ago
This is called a key escrow, which is known for not working, mainly because the assumptions ("once a court order is granted") can't be implemented technically.
- saas_co_de 9y ago
  > known for not working care to provide any evidence for that claim? > ("once a court order is granted") can't be implemented technically we live in the real world. if you can't trust your judiciary then your precious little algorithms aren't going to save you. (sorry to be the bearer of bad news)
  - deleted 9y ago
    [deleted]
Aaargh20318 9y ago
> The government's security for the master key will certainly be much better than the average user's password security so this will not decrease the average user's security in the least. Yes it will. A single user being careless with their password only exposes that user. Leaking the master key (and it will leak) exposes everyone. The target is much bigger, the payoff is much bigger for the bad guys, the risks are immense.

0xfeba 9y ago

Dual-key encryption. You just have to trust the government not to lose their key.