4 ms·

> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can

by lmkg 16y ago

> The courts can probably compel you to enter your password (to decrypt a drive, or what have you), while you can maintain that the content of your password can be protected under the 5th. This is a really subtle point, but in the US this is not (usually) the case, because this is still self-incrimination. You see, by entering the password, you are demonstrating that you have access to the encrypted information, and demonstrating that you have that power is technically self-incrimination. The password is one piece of information that you can't be compelled to divulge, and the fact that you have the password is a separate piece of information, and you cannot be compelled to reveal either. This is also a really important piece of information too, because in order to stick you with any legal consequences associated with the encrypted information, they generally have to prove that you have control over or access to the information. If a file is encrypted it is still possible to reasonably doubt that you have access to its contents despite having access to the physical drive it is on. While it is (currently, as far as I am aware) untested in the court of law, it may be possible to compel someone to use or divulge their password if this does not incriminate the person to do this. I can think of two ways this could happen: a) access/control to the encrypted information has already been proven, so the testimony is of null value b) the prosecution is not allowed to use the fact that you know the password in court, and takes the gamble that they can prove access/control some other way (possibly by using contents of the information). This is, of course, assuming that passwords are classified as "testimony" and therefore protected by the 5th Amendment. If the password is ever recorded on a physical medium such as a piece of paper, that piece of paper is probably not testimony, but rather evidence. This means that, like the key to a safe, it is protected by the 4th Amendment rather than the 5th, and you can be compelled to give up the paper via a warrant. This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? (IANAL, but I've studied the topic as a layman)

jeromec 16y ago
This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)
- billswift 16y ago
  Entering it at a keyboard without mistake would probably be a lot harder.
  - abalashov 16y ago
    And if nothing else, utterly tedious.
  - praptak 16y ago
    For symmetric ciphers, 128 bits, not characters is considered secure. Assuming the uuencode character set [A-Za-z0-9+/] it's 6 bit per character, so 22 chars only. Quite doable.
boredguy8 16y ago
Yes, this is the "act of production" privilege. The Fisher decision established that content is not protected as 'testimonial'. "but the Court has never on any ground, personal privacy included, applied the Fifth Amendment to prevent the otherwise proper acquisition or use of evidence which, in the Court's view, did not involve compelled testimonial self-incrimination of some sort." "The taxpayer cannot avoid compliance with the subpoena merely by asserting that the item of evidence which he is required to pro- duce contains incriminating writing, whether his own or that of someone else" "The existence and location of the papers are a foregone conclu- sion and the taxpayer adds little or nothing to the sum total of the Government's information by conceding that he in fact has the papers. Under these circumstances by enforcement of the summons 'no constitutional rights are touched. The question is not of testimony but of surrender.'" Fisher largely overturned the earlier (1886) Boyd decision. The court did not expand the Fisher limits until 2000, when the Hubbell decision expanded the testimonial aspect of production and limited the scope of the "foregone conclusion" rationale. For more on the act of production privilege, see http://www.georgemasonlawreview.org/doc/17-3_Cowen.pdf http://www.georgemasonlawreview.org/doc/17-3_Cowen.pdf But this all relies on a particularly narrow reading of the role of the password in these questions. You have no right (Boyd being long overturned) to withhold physical evidence that may incriminates you. Anyway, this is an interesting area of law and definitely worth watching.

by lmkg 16y ago

jeromec 16y ago

This presents quite a quandary in deciding which is more secure: a 16-character semi-mnemonic memorizable sequence, or a 128-character random sequence that must be stored on a USB stick? Considering that the record for number of decimal places memorized for Pi appears to be 67,890 I'd argue memorizing a 128-character random sequence would be both possible and most secure. ;)

billswift 16y ago
Entering it at a keyboard without mistake would probably be a lot harder.
- abalashov 16y ago
  And if nothing else, utterly tedious.
- praptak 16y ago
  For symmetric ciphers, 128 bits, not characters is considered secure. Assuming the uuencode character set [A-Za-z0-9+/] it's 6 bit per character, so 22 chars only. Quite doable.

boredguy8 16y ago

Yes, this is the "act of production" privilege. The Fisher decision established that content is not protected as 'testimonial'. "but the Court has never on any ground, personal privacy included, applied the Fifth Amendment to prevent the otherwise proper acquisition or use of evidence which, in the Court's view, did not involve compelled testimonial self-incrimination of some sort." "The taxpayer cannot avoid compliance with the subpoena merely by asserting that the item of evidence which he is required to pro- duce contains incriminating writing, whether his own or that of someone else" "The existence and location of the papers are a foregone conclu- sion and the taxpayer adds little or nothing to the sum total of the Government's information by conceding that he in fact has the papers. Under these circumstances by enforcement of the summons 'no constitutional rights are touched. The question is not of testimony but of surrender.'" Fisher largely overturned the earlier (1886) Boyd decision. The court did not expand the Fisher limits until 2000, when the Hubbell decision expanded the testimonial aspect of production and limited the scope of the "foregone conclusion" rationale. For more on the act of production privilege, see http://www.georgemasonlawreview.org/doc/17-3_Cowen.pdf http://www.georgemasonlawreview.org/doc/17-3_Cowen.pdf But this all relies on a particularly narrow reading of the role of the password in these questions. You have no right (Boyd being long overturned) to withhold physical evidence that may incriminates you. Anyway, this is an interesting area of law and definitely worth watching.