4 ms·

Never forget the great TSA Master Key fiasco. To facilitate airline baggage security while easing bag searches, the TSA approved locks which could be opened wi

Never forget the great TSA Master Key fiasco. To facilitate airline baggage security while easing bag searches, the TSA approved locks which could be opened with a master key (well, one from a small set of keys). These keys, like the "golden key" in the indicated article, were carefully guarded. Anyone using a luggage lock that either wasn't TSA-master-key-compliant, or not already open, was of course considered with great suspicion. Then someone wrote an article about it. And talked a TSA security agent into posing with the keys displayed. http://www.extremetech.com/wp-content/uploads/2015/09/CM8Naj7UwAAN6co.jpg http://www.extremetech.com/wp-content/uploads/2015/09/CM8Naj... was published, and within hours people were 3D-printing copies. Never forget the great DVD CSS fiasco. To ward off unauthorized copying, DVDs were encrypted. Authorized playback devices were given the secret decryption key. Controlled properly, this key would never be actually revealed. Then someone didn't control it properly, storing it unsecured in a playback product. The key was found, copied, disseminated, and DeCSS software proliferated. It was even printed on t-shirts: https://c2.staticflickr.com/4/3451/3228250152_cf84bbd87d_b.jpg https://c2.staticflickr.com/4/3451/3228250152_cf84bbd87d_b.j... No, it's not "going to be different this time". Universal back-door keys get compromised/copied/disseminated eventually.

Nursie 9y ago
DeCSS was more about the CSS scheme being trivial to break, wasn't it? We went through it in Coursera's crypto-1 course, as soon as you can see how it works you can see how to break it pretty trivially and recover the key.
- ctdonath 9y ago
  In retrospect, yes it's easy to break. Getting to that understanding, however, was greatly facilitated by the aforementioned key leak. I recall the great excitement when it happened, and the subsequent proposals of making that number "illegal" (discouraging dissemination). Upshot, regardless of technical details: we've been over the "golden key law" concept many times thru several decades, with numerous dramatic examples of why it's a really really bad idea. We can continue arguing about what exactly went wrong then, and why "it will be different this time", but if we've learned anything it's "no, it won't be different this time."
tomjen3 9y ago
Even better, the HDMI encryption system was made to handle that leak - rather than have one key, each manufacturer would have one key and then they disable any leaked keys. Worked wonderfully, until somebody posted the master key matrix...

Nursie 9y ago

DeCSS was more about the CSS scheme being trivial to break, wasn't it? We went through it in Coursera's crypto-1 course, as soon as you can see how it works you can see how to break it pretty trivially and recover the key.

ctdonath 9y ago
In retrospect, yes it's easy to break. Getting to that understanding, however, was greatly facilitated by the aforementioned key leak. I recall the great excitement when it happened, and the subsequent proposals of making that number "illegal" (discouraging dissemination). Upshot, regardless of technical details: we've been over the "golden key law" concept many times thru several decades, with numerous dramatic examples of why it's a really really bad idea. We can continue arguing about what exactly went wrong then, and why "it will be different this time", but if we've learned anything it's "no, it won't be different this time."

tomjen3 9y ago

Even better, the HDMI encryption system was made to handle that leak - rather than have one key, each manufacturer would have one key and then they disable any leaked keys. Worked wonderfully, until somebody posted the master key matrix...