8 ms·

Modern encryption is really just math. Cryptography in consumer and off-the-shelf products (which Barr is targeting with his discussion) theoretically _could_ b

Modern encryption is really just math. Cryptography in consumer and off-the-shelf products (which Barr is targeting with his discussion) theoretically _could_ be modified in such a way that the government could decrypt it. The two ways of which I can think are (1) Encryption "backdoors" -- fancy math known only to the government; this would require new encryption ciphers or (b) key escrow. Both approaches have their shortcomings and I'm against both, but it's plausible that the government might try it anyway. All that said, because encryption is just math, any individual or group could employ their own encryption by implementing one of any known existing ciphers -- one without a known "fancy math back door" and refuse to follow the "key escrow" guidelines. In these discussions about the government being able to decrypt stuff, are we, in effect, suggesting that certain math be made illegal? If that's really what's being proposed, I'd urge people to consider "Illegal Numbers" and how effective that's been. https://en.wikipedia.org/wiki/Illegal_number https://en.wikipedia.org/wiki/Illegal_number

api 7y ago
This is all true, but I think encryption backdoors are more possible than people think. The target here is not nerds able to pull code from GitHub or run open source or enterprise software. The target here is consumer stuff by companies like Apple and Google. The government doesn't want it to be easy to do end-to-end encryption. For the average user, easy equals possible. The average user has neither the time nor the expertise to roll their own solution or run nerd tools. Look at how PGP/GPG's complexity and absolutely horrible UX (even for technical users!) has prevented e-mail encryption from ever taking off. This reminds me of what a government guy told me about crypto export controls. Yes, they know that crypto export controls won't stop nerds using GitHub. What they want to do is to stop IBM, Google, Apple, Cisco, Juniper, etc. from selling ready-made polished crypto products to blacklisted countries. In both cases I think the target is large corporations not individuals and the goal is to make crypto hard and keep it out of the hands of the average user or less-technical foreign organization. That being said I still don't think it'll work. Just pointing out the thinking that's going on here.
- awakeasleep 7y ago
  The scenario you described accomplishes both goals. By banning 'the masses' from using encrypted communications, it'll sort the haystack and everyone who continues to do so can be profiled, plus they're already involved in illegal behavior.
  - adamc 7y ago
    How so? Couldn't we come up with a way of disguising encrpyted message streams so that they did not stand out? It would be more expensive, and given enough analysis they could probably detect them anyway, but it strikes me as an arms race.
  - dewaine 7y ago
    You better believe I would start streaming random data all over the internet just to be an asshole
    - inetknght 7y ago
      Then, in the US, you have obstruction of justice and/or interference with police/peace/public officer.
      - dewaine 7y ago
        I think it's more of a protest, or am I not allowed to email myself numbers?
        inetknght 7y ago
        You are, up until the point where it's cost a law enforcement officer time to determine that either the numbers are intended to waste their time or that the numbers are a hidden/unbackdoored encryption. Then you're GG SOL
        dewaine 7y ago
MrLeap 7y ago
Breaking encryption for the government is so furiously stupid it blows my mind every time it is suggested. Especially here, where people actually give the idea merit. It makes me miss oldschool /. where 100% of everyone was on the same page. Your point illustrates a huge reason as to why. Backdooring stupid.crypt and forcing law abiding people to use it just insures that big badguys will use any other kind of encryption. All you've really accomplished is adding an extra charge of illegal encryption use at the expense of security for every human. This potentially creates all sorts of pathologies. Is it illegal now for me not to update an old computer? If your backdoors are implemented in hardware, is it illegal to use old computers? When people are against gun control, a common thread is "make guns illegal and only criminals will have guns." This argument has merit, but if we DID amend out #2 and make guns illegal, over time firearm proliferation would decrease. Not so with encryption. Other, more free countries will constantly be developing better security methodologies, and reproducing those methods is effectively free. "Fuck up encryption, then only bad guys will have encryption" is a much stronger argument, because it's emphatically true. The ignorant hubris of this is massively disheartening.
- coldpie 7y ago
  > Breaking encryption for the government is so furiously stupid it blows my mind every time it is suggested. Yeah. There's no distinction whatsoever between encryption with backdoors and no encryption at all. Imagine our current web with no encryption. Your logins are all effectively plaintext; your online shopping is effectively plaintext; your emails are all effectively plaintext. "Furiously stupid" is a good way to describe this whole proposition.
- thetrumanshow 7y ago
  > This argument has merit, but if we DID amend out #2 and make guns illegal, over time firearm proliferation would decrease. Hmm, then wouldn't some people just make their own firearms, just as you are describing with encryption, right?
  - jki275 7y ago
    Many people do that already, perfectly legally. Certainly some percentage would choose not to follow laws banning them.
teunispeters 7y ago
Key escrow has a number of problems, not the least enforcement that keys are valid and validated. (something that there's not a good history of, and international issues come up) Back doors are worse though - build a back door and it will be used, just not necessarily by the agency it was built for. There are a lot of groups with a lot of resources oriented around taking advantage of this, and few are legitimate. (and some are enemy nations). There's a third problem - doing it in such a way that it can't be blocked from monitoring. (see "clipper chip" for more on that).
cortesoft 7y ago
I totally get what you are saying, but it is quite the rabbit hole if we determine that 'we can't have any illegal number... everyone should be able to share any number with anyone else' That basically means we have to entirely get rid of copyright, since all data (books, movies, software, corporate secrets, state secrets, etc) are just very large numbers. Do we believe that there should be no restriction on the sharing of any data? I can see the appeal, but there are far reaching consequences if we say that.
- inetknght 7y ago
  Care to run down that rabbit hole? I happen to think copyright is a concept which is intrinsically broken with the advent of modern computing power and connectivity.
  - thomastjeffery 7y ago
    While I happen to agree with you, I think it's important to distinguish the two: What A.G. Barr is insinuating is to regulate algorithms. Copyright is regulation of implementations. For example, GPG is a software implementation of encryption algorithms. It has a copyright (used as the basis for its copyleft license). RSA, however, is an algorithm: a mathematical reality that can be described by copyrighted works, but never itself copyrighted. A.G. Barr has expressed a desire to compel every American who implements that algorithm to do so incorrectly.
    - deleted 7y ago
      [deleted]
- braythwayt 7y ago
  We don’t need to use copyright as an example. Words are just data. Are there illegal combinations of words to exchange? The law says, YES. Some speech is absolutely illegal, including making credible death threats, conspiring to break other laws, or disclosing certain state secrets to foreign powers. Very few people argue that since words are easily available to everyone, that it is futile to make some combinations of words illegal.
txcwpalpha 7y ago
>are we, in effect, suggesting that certain math be made illegal? If that's really what's being proposed, I'd urge people to consider "Illegal Numbers" and how effective that's been. I keep seeing this "implausibility" of enforcing illegal encryption brought up, and I really think it's wishful thinking. If such encryption algorithms ever are made illegal in some manner, it will be trivial for the government to get the result they want. It won't be about completely stopping people from using AES, nor will it be about imprisoning every person who continues to use it. What it will be about is turning "this target of our investigation is using illegal encryption" into an immediate cause for search/arrest warrant. And that will be more than enough for 95%+ of the purposes they're looking for.
- wurst_case 7y ago
  True, and this should frighten everyone. You'd be a suspected terrorist or criminal for using a VPN or tor or any foreign service that doesnt use the gov approved crypt. As long as you stayed out of the limelight and kept your head down you'd be fine. But if anyone looked into your activity, it would be easy to determine that you weren't using gov-crypt. This is inheritely authoritarian.
  - asshat1 7y ago
    I can think of a few ways to make this a real pain for law enforcement. Sure I use my crypto to encrypt a tunnel then you use yours to encrypt a tunnel etc.... Make an onion out of the cryptosystem and law enforcement has got to get piles of warrants to cut through the various layers. It's stupid, sort of like a fourth ammensment onion router
JudgeWapner 7y ago
For centuries, the law has recognized information as property. Encryption is just a transform of information. The government can argue that they're simply banning certain types of property - something they've done for at least 100 years, maybe longer.
- nixpulvis 7y ago
  Can you explain how this actually solves the main problems? I can see this form of encryption catching unsophisticated "bad hombres". Unsophisticated here meaning, either ignorant of weaknesses in the technology they use, or aware, but unable to improve upon it. The most motivated adversaries will make use of other schemes. Worse, for secrets we actually care about (nuclear codes?) we must still research proper encryption schemes since backdoors are admissions of weakness in a security protocol fundamentally as far as I've come to understand. > We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement without materially weakening the security provided by encryption. Such encryption regimes already exist. For example, providers design their products to allow access for software updates using centrally managed security keys. We know of no instance where encryption has been defeated by compromise of those provider-maintained keys. Providers have been able to protect them. This quote from the article seems to contradict itself. First it claims "... without materially weakening the security provided by encryption" then goes on to state "We know of no instance where encryption has been defeated by compromise of those provider-maintained keys" implying that there is a possibility of this kind of breach. This whole thing seems like an oligarch's attempt to spy on it's people pretty plainly to me. Where is the liberty and freedom in this?
  - JudgeWapner 7y ago
    > Can you explain how this actually solves the main problems? a lot of weight rests on those two words: "main problems". The main problems for the government are that criminal investigations are being impeded. By banning certain forms of encryption, they can criminally charge a suspect for merely refusing to decrypt data. And you can bet that the penalties will be stackable, allowing the government to use its discretion and perhaps charging someone with separate counts for each file he refuses (or is unable ...) to decrypt. I'm NAL, but I've also heard of the "forgone conclusion" doctrine, which somehow allows the constitution to fly out the window and allows the gov to imprison someone indefinitely until they decrypt the files. So, sadly, this ban does solve the main problems at considerable expense to citizens' liberties. Conjecturing further: - citizens would be allowed to encrypt, but they'd be required to keep a set of the keys used or else they could risk prosecution. - There could be a government cloud server where you "securely" upload whatever keys you use (or, realistically, probably outsourced to companies like equifax which would then charge you a fee to do so), - existing cloud providers would be required to detect when clients were using encryption-looking libraries/subroutines and store a copy of the keys into some registry. - this could ultimately lead to "whitelist-only" software libraries, so that you cannot run anything on the cloud without building it with their dev environment so they can be sure you're not secretly encrypting things. - going even further, this could lead to deep packet inspection that simply detects encrypted transactions and queries them against the gov key registry to "make sure" they are properly decryptable. Any failures to decrypt could trigger an investigation.
SkyBelow 7y ago
>In these discussions about the government being able to decrypt stuff, are we, in effect, suggesting that certain math be made illegal? All images are binary. All binary is just a number. We have made many such numbers illegal and even have software that will detect them and report you when you share the number with such number sharing services (dropbox, facebook, etc). So making math illegal sounds entirely possible.
- thomastjeffery 7y ago
  You are talking about data, so following that logic, what would be made illegal would be implementations not algorithms. Math can be represented in a variety of ways, but the pattern being described is immutable. What A.G. Barr is insinuating is not that we make implementations illegal, but that we make the use of algorithms categorically illegal.
  - SkyBelow 7y ago
    While I don't know of any, had someone made an algorithm that could generate such illegal numbers I suspect it would be considered illegal from the first day of its existence.
nixpulvis 7y ago
> We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement without materially weakening the security provided by encryption. False. Also "technical solutions" makes it sound like the issue is in inventing the correct encryption scheme. Whereas in reality the issue exists because we have discovered (currently) unbreakable codes, and the invention of broken (backdoored) schemes does little to change that. If we break all known forms of encryption, and find a reasonable proof that they are no longer possible, then I'll be more interested in this line of reasoning. And that's a pretty big if.

api 7y ago

This is all true, but I think encryption backdoors are more possible than people think. The target here is not nerds able to pull code from GitHub or run open source or enterprise software. The target here is consumer stuff by companies like Apple and Google. The government doesn't want it to be easy to do end-to-end encryption. For the average user, easy equals possible. The average user has neither the time nor the expertise to roll their own solution or run nerd tools. Look at how PGP/GPG's complexity and absolutely horrible UX (even for technical users!) has prevented e-mail encryption from ever taking off. This reminds me of what a government guy told me about crypto export controls. Yes, they know that crypto export controls won't stop nerds using GitHub. What they want to do is to stop IBM, Google, Apple, Cisco, Juniper, etc. from selling ready-made polished crypto products to blacklisted countries. In both cases I think the target is large corporations not individuals and the goal is to make crypto hard and keep it out of the hands of the average user or less-technical foreign organization. That being said I still don't think it'll work. Just pointing out the thinking that's going on here.

awakeasleep 7y ago
The scenario you described accomplishes both goals. By banning 'the masses' from using encrypted communications, it'll sort the haystack and everyone who continues to do so can be profiled, plus they're already involved in illegal behavior.
- adamc 7y ago
  How so? Couldn't we come up with a way of disguising encrpyted message streams so that they did not stand out? It would be more expensive, and given enough analysis they could probably detect them anyway, but it strikes me as an arms race.
- dewaine 7y ago
  You better believe I would start streaming random data all over the internet just to be an asshole
  - inetknght 7y ago
    Then, in the US, you have obstruction of justice and/or interference with police/peace/public officer.
    - dewaine 7y ago
      I think it's more of a protest, or am I not allowed to email myself numbers?
      - inetknght 7y ago
        You are, up until the point where it's cost a law enforcement officer time to determine that either the numbers are intended to waste their time or that the numbers are a hidden/unbackdoored encryption. Then you're GG SOL
        dewaine 7y ago

MrLeap 7y ago

Breaking encryption for the government is so furiously stupid it blows my mind every time it is suggested. Especially here, where people actually give the idea merit. It makes me miss oldschool /. where 100% of everyone was on the same page. Your point illustrates a huge reason as to why. Backdooring stupid.crypt and forcing law abiding people to use it just insures that big badguys will use any other kind of encryption. All you've really accomplished is adding an extra charge of illegal encryption use at the expense of security for every human. This potentially creates all sorts of pathologies. Is it illegal now for me not to update an old computer? If your backdoors are implemented in hardware, is it illegal to use old computers? When people are against gun control, a common thread is "make guns illegal and only criminals will have guns." This argument has merit, but if we DID amend out #2 and make guns illegal, over time firearm proliferation would decrease. Not so with encryption. Other, more free countries will constantly be developing better security methodologies, and reproducing those methods is effectively free. "Fuck up encryption, then only bad guys will have encryption" is a much stronger argument, because it's emphatically true. The ignorant hubris of this is massively disheartening.

coldpie 7y ago
> Breaking encryption for the government is so furiously stupid it blows my mind every time it is suggested. Yeah. There's no distinction whatsoever between encryption with backdoors and no encryption at all. Imagine our current web with no encryption. Your logins are all effectively plaintext; your online shopping is effectively plaintext; your emails are all effectively plaintext. "Furiously stupid" is a good way to describe this whole proposition.
thetrumanshow 7y ago
> This argument has merit, but if we DID amend out #2 and make guns illegal, over time firearm proliferation would decrease. Hmm, then wouldn't some people just make their own firearms, just as you are describing with encryption, right?
- jki275 7y ago
  Many people do that already, perfectly legally. Certainly some percentage would choose not to follow laws banning them.

teunispeters 7y ago

Key escrow has a number of problems, not the least enforcement that keys are valid and validated. (something that there's not a good history of, and international issues come up) Back doors are worse though - build a back door and it will be used, just not necessarily by the agency it was built for. There are a lot of groups with a lot of resources oriented around taking advantage of this, and few are legitimate. (and some are enemy nations). There's a third problem - doing it in such a way that it can't be blocked from monitoring. (see "clipper chip" for more on that).

cortesoft 7y ago

I totally get what you are saying, but it is quite the rabbit hole if we determine that 'we can't have any illegal number... everyone should be able to share any number with anyone else' That basically means we have to entirely get rid of copyright, since all data (books, movies, software, corporate secrets, state secrets, etc) are just very large numbers. Do we believe that there should be no restriction on the sharing of any data? I can see the appeal, but there are far reaching consequences if we say that.

inetknght 7y ago
Care to run down that rabbit hole? I happen to think copyright is a concept which is intrinsically broken with the advent of modern computing power and connectivity.
- thomastjeffery 7y ago
  While I happen to agree with you, I think it's important to distinguish the two: What A.G. Barr is insinuating is to regulate algorithms. Copyright is regulation of implementations. For example, GPG is a software implementation of encryption algorithms. It has a copyright (used as the basis for its copyleft license). RSA, however, is an algorithm: a mathematical reality that can be described by copyrighted works, but never itself copyrighted. A.G. Barr has expressed a desire to compel every American who implements that algorithm to do so incorrectly.
  - deleted 7y ago
    [deleted]
braythwayt 7y ago
We don’t need to use copyright as an example. Words are just data. Are there illegal combinations of words to exchange? The law says, YES. Some speech is absolutely illegal, including making credible death threats, conspiring to break other laws, or disclosing certain state secrets to foreign powers. Very few people argue that since words are easily available to everyone, that it is futile to make some combinations of words illegal.

txcwpalpha 7y ago

>are we, in effect, suggesting that certain math be made illegal? If that's really what's being proposed, I'd urge people to consider "Illegal Numbers" and how effective that's been. I keep seeing this "implausibility" of enforcing illegal encryption brought up, and I really think it's wishful thinking. If such encryption algorithms ever are made illegal in some manner, it will be trivial for the government to get the result they want. It won't be about completely stopping people from using AES, nor will it be about imprisoning every person who continues to use it. What it will be about is turning "this target of our investigation is using illegal encryption" into an immediate cause for search/arrest warrant. And that will be more than enough for 95%+ of the purposes they're looking for.

wurst_case 7y ago
True, and this should frighten everyone. You'd be a suspected terrorist or criminal for using a VPN or tor or any foreign service that doesnt use the gov approved crypt. As long as you stayed out of the limelight and kept your head down you'd be fine. But if anyone looked into your activity, it would be easy to determine that you weren't using gov-crypt. This is inheritely authoritarian.
- asshat1 7y ago
  I can think of a few ways to make this a real pain for law enforcement. Sure I use my crypto to encrypt a tunnel then you use yours to encrypt a tunnel etc.... Make an onion out of the cryptosystem and law enforcement has got to get piles of warrants to cut through the various layers. It's stupid, sort of like a fourth ammensment onion router

JudgeWapner 7y ago

For centuries, the law has recognized information as property. Encryption is just a transform of information. The government can argue that they're simply banning certain types of property - something they've done for at least 100 years, maybe longer.

nixpulvis 7y ago
Can you explain how this actually solves the main problems? I can see this form of encryption catching unsophisticated "bad hombres". Unsophisticated here meaning, either ignorant of weaknesses in the technology they use, or aware, but unable to improve upon it. The most motivated adversaries will make use of other schemes. Worse, for secrets we actually care about (nuclear codes?) we must still research proper encryption schemes since backdoors are admissions of weakness in a security protocol fundamentally as far as I've come to understand. > We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement without materially weakening the security provided by encryption. Such encryption regimes already exist. For example, providers design their products to allow access for software updates using centrally managed security keys. We know of no instance where encryption has been defeated by compromise of those provider-maintained keys. Providers have been able to protect them. This quote from the article seems to contradict itself. First it claims "... without materially weakening the security provided by encryption" then goes on to state "We know of no instance where encryption has been defeated by compromise of those provider-maintained keys" implying that there is a possibility of this kind of breach. This whole thing seems like an oligarch's attempt to spy on it's people pretty plainly to me. Where is the liberty and freedom in this?
- JudgeWapner 7y ago
  > Can you explain how this actually solves the main problems? a lot of weight rests on those two words: "main problems". The main problems for the government are that criminal investigations are being impeded. By banning certain forms of encryption, they can criminally charge a suspect for merely refusing to decrypt data. And you can bet that the penalties will be stackable, allowing the government to use its discretion and perhaps charging someone with separate counts for each file he refuses (or is unable ...) to decrypt. I'm NAL, but I've also heard of the "forgone conclusion" doctrine, which somehow allows the constitution to fly out the window and allows the gov to imprison someone indefinitely until they decrypt the files. So, sadly, this ban does solve the main problems at considerable expense to citizens' liberties. Conjecturing further: - citizens would be allowed to encrypt, but they'd be required to keep a set of the keys used or else they could risk prosecution. - There could be a government cloud server where you "securely" upload whatever keys you use (or, realistically, probably outsourced to companies like equifax which would then charge you a fee to do so), - existing cloud providers would be required to detect when clients were using encryption-looking libraries/subroutines and store a copy of the keys into some registry. - this could ultimately lead to "whitelist-only" software libraries, so that you cannot run anything on the cloud without building it with their dev environment so they can be sure you're not secretly encrypting things. - going even further, this could lead to deep packet inspection that simply detects encrypted transactions and queries them against the gov key registry to "make sure" they are properly decryptable. Any failures to decrypt could trigger an investigation.

SkyBelow 7y ago

>In these discussions about the government being able to decrypt stuff, are we, in effect, suggesting that certain math be made illegal? All images are binary. All binary is just a number. We have made many such numbers illegal and even have software that will detect them and report you when you share the number with such number sharing services (dropbox, facebook, etc). So making math illegal sounds entirely possible.

thomastjeffery 7y ago
You are talking about data, so following that logic, what would be made illegal would be implementations not algorithms. Math can be represented in a variety of ways, but the pattern being described is immutable. What A.G. Barr is insinuating is not that we make implementations illegal, but that we make the use of algorithms categorically illegal.
- SkyBelow 7y ago
  While I don't know of any, had someone made an algorithm that could generate such illegal numbers I suspect it would be considered illegal from the first day of its existence.

nixpulvis 7y ago

> We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement without materially weakening the security provided by encryption. False. Also "technical solutions" makes it sound like the issue is in inventing the correct encryption scheme. Whereas in reality the issue exists because we have discovered (currently) unbreakable codes, and the invention of broken (backdoored) schemes does little to change that. If we break all known forms of encryption, and find a reasonable proof that they are no longer possible, then I'll be more interested in this line of reasoning. And that's a pretty big if.