4 ms·

> There's absolutely no way to give police a back door into encryption without giving criminals the same back door. This feels disingenuous to me. It would be

by Gaelan 8y ago

> There's absolutely no way to give police a back door into encryption without giving criminals the same back door. This feels disingenuous to me. It would be fairly trivial, for example, to store a copy of all keys, encrypted with the government’s public key. Of course, there’s a million eats to go wrong, but that’s different from “mathematically impossible.”

sprucely 8y ago
But the million ways to go wrong IS the problem. I may be appealing to authority here, but is it disingenuous when an overwhelming majority of encryption and security experts agree? https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/06/11/the-cybersecurity-202-we-surveyed-100-experts-a-majority-rejected-the-fbi-s-push-for-encryption-back-doors/5b1d39eb1b326b6391af094a/?utm_term=.cebc72f7c3b1 https://www.washingtonpost.com/news/powerpost/paloma/the-cyb... https://www.schneier.com/blog/archives/2018/05/ray_ozzies_encr.html https://www.schneier.com/blog/archives/2018/05/ray_ozzies_en... https://www.justsecurity.org/53316/criminalize-security-criminals-secure/ https://www.justsecurity.org/53316/criminalize-security-crim...
- tzs 8y ago
  Note that he was replying to a comment that was saying that a back door that is not wide open to criminals is comparable to thinking pi = 3. As is pointed out in the Schneier article, the problems with a key escrow scheme are on the law enforcement side of things. They could lose access to their keys, especially if a lot of different agencies have keys. Those are difficulties that can in theory be overcome, although it may not be practical to do so. That's a far cry from a pi = 3 issue.
  - mattnewton 8y ago
    The original argument was “The legislation in no way compromises the security of any Australians’ digital communications.” This is approaching a pi = 3 level falsehood because of the “in no way compromises” clause. There are many schemes that are outright illegal (in my not a lawyer interpretation of this law), and it nakedly makes the other schemes harder with state actors as additional points of failure.
- msla 8y ago
  Appealing to authority is only a bad argument if the authority is irrelevant to the topic. Appealing to Schneier on the topic of encryption is not an irrelevant appeal.
mattnewton 8y ago
Well, that does actually make some schemes impossible (in a pi = 3 kind of impossible) because it means the private key has to leave someone’s device and be sent over the wire- and many schemes don’t do that. https://en.m.wikipedia.org/wiki/Three-pass_protocol https://en.m.wikipedia.org/wiki/Three-pass_protocol I’m not a cryptographer but I assume there are other schemes that are at least weakened by the requirement of a third party holding a key, much like the TSA master lock program was broken by statistical analysis of locks that were mastered this way. But the mathematical impossibility if this aside, there is a very real practical impossibility if trusting an organization as large as the US government to keep such a database secure. There are better ways to help law enforcement than blowing such a large gaping hole in the web.

by Gaelan 8y ago

sprucely 8y ago

But the million ways to go wrong IS the problem. I may be appealing to authority here, but is it disingenuous when an overwhelming majority of encryption and security experts agree? https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2018/06/11/the-cybersecurity-202-we-surveyed-100-experts-a-majority-rejected-the-fbi-s-push-for-encryption-back-doors/5b1d39eb1b326b6391af094a/?utm_term=.cebc72f7c3b1 https://www.washingtonpost.com/news/powerpost/paloma/the-cyb... https://www.schneier.com/blog/archives/2018/05/ray_ozzies_encr.html https://www.schneier.com/blog/archives/2018/05/ray_ozzies_en... https://www.justsecurity.org/53316/criminalize-security-criminals-secure/ https://www.justsecurity.org/53316/criminalize-security-crim...

tzs 8y ago
Note that he was replying to a comment that was saying that a back door that is not wide open to criminals is comparable to thinking pi = 3. As is pointed out in the Schneier article, the problems with a key escrow scheme are on the law enforcement side of things. They could lose access to their keys, especially if a lot of different agencies have keys. Those are difficulties that can in theory be overcome, although it may not be practical to do so. That's a far cry from a pi = 3 issue.
- mattnewton 8y ago
  The original argument was “The legislation in no way compromises the security of any Australians’ digital communications.” This is approaching a pi = 3 level falsehood because of the “in no way compromises” clause. There are many schemes that are outright illegal (in my not a lawyer interpretation of this law), and it nakedly makes the other schemes harder with state actors as additional points of failure.
msla 8y ago
Appealing to authority is only a bad argument if the authority is irrelevant to the topic. Appealing to Schneier on the topic of encryption is not an irrelevant appeal.

mattnewton 8y ago

Well, that does actually make some schemes impossible (in a pi = 3 kind of impossible) because it means the private key has to leave someone’s device and be sent over the wire- and many schemes don’t do that. https://en.m.wikipedia.org/wiki/Three-pass_protocol https://en.m.wikipedia.org/wiki/Three-pass_protocol I’m not a cryptographer but I assume there are other schemes that are at least weakened by the requirement of a third party holding a key, much like the TSA master lock program was broken by statistical analysis of locks that were mastered this way. But the mathematical impossibility if this aside, there is a very real practical impossibility if trusting an organization as large as the US government to keep such a database secure. There are better ways to help law enforcement than blowing such a large gaping hole in the web.