10 ms·

Why can't we have both security as well as court ordered access. What would be the problems if we had 5 HSM that are airgapped and located at secure facilities.

Why can't we have both security as well as court ordered access. What would be the problems if we had 5 HSM that are airgapped and located at secure facilities. Encrypted applications (such as WhatsApp, Apple Messenger, etc) are required to submit/transmit escrow keys that are encrypted with the public keys of those 5 HSM's. After a valid court order, a law enforcement official has to physically go to one of the secure locations with those encrypted escrow keys which will then be decrypted by the HSM. This way, everyone can have secure communication, but still allow legitimate law enforcement searches when ordered by a judge.

jjoonathan 7y ago
These people couldn't stop the OPM database -- blackmail on all of their sensitive personnel -- from getting hacked, and that's something they wanted to protect. Now imagine how good a job they would do of protecting something they resented, like the escrow mechanism in your proposal. Yeah.
LocalPCGuy 7y ago
And when one of those keys gets out? (Which will happen)
- RcouF1uZ4gsC 7y ago
  The whole point of an HSM is that those keys cannot get out.
  - w3rhn2j34oh5o 7y ago
    The point, yes, but it is not the case in reality: 2015: https://cryptosense.com/blog/the-untold-story-of-pkcs11-hsm-vulnerabilities/ https://cryptosense.com/blog/the-untold-story-of-pkcs11-hsm-... 2017: https://cryptosense.com/blog/infineon-rsa-key-generation-bug-how-the-attack-works-and-what-to-do/ https://cryptosense.com/blog/infineon-rsa-key-generation-bug... 2019: https://cryptosense.com/blog/how-ledger-hacked-an-hsm/ https://cryptosense.com/blog/how-ledger-hacked-an-hsm/ Stop trying to build scenarios where key escrow solutions are technically sound. They are not. This is an intractable problem that is not solved by these half cocked technical measures. Key escrow cannot by definition be secure, and wasting time trying to invent solutions just confuses the matter, weakens security and leaves us all vulnerable. Basically, Sssssssh, or the politicians might actually believe this fantasy.
  - zeveb 7y ago
    The HSM can get out, by being stolen.
  - ska 7y ago
    > The whole point of an HSM is that those keys cannot get out. On paper, sure. In practice, not so much.
  - readams 7y ago
    There is basically no limit to the amount of money that it would be worth paying for a government to get those HSMs, since they could decrypt nearly all the world's communication. And the country in which they are hosted is included in the threat model. I would not want to be the one tasked with attempting to keep it secure.
DuskStar 7y ago
Assuming those keys are truly secure, two reasons: 1. No one trusts the government not to abuse such a power. "Only usable with a valid court order" my ass. 2. The government doesn't trust citizens not to change around the escrow keys used (which would prevent them from decrypting things)
- mabbo 7y ago
  "a valid court order" is an impossible task. Courts are run by judges, who are human and subject to bribing, blackmail, or being wrong.
Analemma_ 7y ago
Once the United States has a backdoor key, every other nation will demand one as well, and there won't be any grounds to refuse. Which creates two problems: - Obviously you can't reuse the same master key, so now you need 180+ keys, meaning 180+ backdoors into the system. It is ridiculous to expect that all of these will remain secure; the United States can't even secure the OPM database so even ours will probably be leaked, and countries with more bribe-prone law enforced will give it up even faster, and now everyone is pwned. - Law enforcement are frequently the bad guys. YMMV on how often this is the case in the United States but it's certainly inarguably the case in many places abroad. Mandatory backdoors means no possibility for secure communications about dissidents and "inconvenients" in those countries.
akersten 7y ago
No, I would not call that secure communication, because it can be accessed by someone other than the intended recipient. The number of hoops they have to jump through is irrelevant. It is not possible to have secure by definition communication and facilitate a backdoor at the same time. The two concepts are strictly mutually exclusive. In the United States you have the amazing freedom to communicate in any language you desire (including one unintelligible to a would-be snoop), and the State cannot force you to translate your communications just because they want to hear them. We should not be so eager to give up that freedom in our digital lives.
- rubinelli 7y ago
  I'm surprised that Americans aren't pushing to make private and secure communication a constitutional right. Will it make it harder for law enforcement to go after "bad guys"? Yes. Just as the second, fourth, and fifth amendments do today.
  - gizmo686 7y ago
    The US classifies encryption as a munition. I am genuinly suprised there hasn't been a push to get it covered under the second amendment.
    - vorpalhex 7y ago
      "Sir, you're going to need an ID, a fingerprint card, and approval from the FBI before you can download that browser."
    - bitwize 7y ago
      Crypto is munitions for export purposes, I doubt you can get a ruling that it qualifies for 2A protection. The law is like that. The law can classify a thing as one thing for one purpose, and another thing for another purpose. If they want to ban crypto, they could classify it as a Schedule I drug and it'd make about as much sense as classifying it as a munition.
    - homonculus1 7y ago
zzzcpan 7y ago
> but still allow legitimate law enforcement searches when ordered by a judge You can already do that by voluntarily providing access to your devices to anyone you want, including law enforcement. Other people don't necessarily share your ideology and accept that there could exist "legitimate law enforcement searches" of their private communications.
throw0101a 7y ago
> Why can't we have both security as well as court ordered access. Waterboarding was treated as a crime by the US during WW2: * https://en.wikipedia.org/wiki/Waterboarding#World_War_II https://en.wikipedia.org/wiki/Waterboarding#World_War_II And then conveniently it was not a crime after 9/11: * https://en.wikipedia.org/wiki/Waterboarding#Classification_in_the_U.S https://en.wikipedia.org/wiki/Waterboarding#Classification_i.... Access to the escrowed keys may also be conveniently reclassified in the future. And that assumes that the law is even followed: you can't trust that the "court ordered access" will remain only court ordered. Law enforcement agencies have violated laws in the past as a matter of policy: * https://en.wikipedia.org/wiki/COINTELPRO https://en.wikipedia.org/wiki/COINTELPRO
GordonS 7y ago
It's a slippery slope - there would undoubtedly be a creeping escalation, with more and more agencies and people given access, and the requirements to get access relaxed. Before you know it, the CIA is hoovering up everything, local police departments have unfettered access and the local environmental agency can easily request access to anything for "reasons". Governments have shown time and again that they abuse any power they get - I wouldn't trust them with this.
Znafon 7y ago
If reading the message require those 5 HSM, how does your recipient can read your message?
- wmf 7y ago
  You encrypt the message twice so that either the intended recipient or the government with 5 HSMs can decrypt it.
  - w3rhn2j34oh5o 7y ago
    Or whomever has hacked the source control / build environment to replace the "5 magic HSM public keys" with one or more of their own public keys -- See Juniper Incident with Dual-EC DRBG (https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf) This story should be repeated whenever anyone brings up 'solutions' involved with key escrow. Bruce warned us in 2006 this was a backdoor, ten years later, we find that not only was it implemented by Juniper, the backdoor was backdoored by unknown (and potentially malicious) actors. Really, this should be the last word on why this key escrow and general cryptographic backdoors are a terrible terrible idea.
    - Spivak 7y ago
      Entity that compromised a system completely and can read the unencrypted messages... can read the unencrypted messages? In other news giving someone root access to your machine gives them root access.
  - PeterisP 7y ago
    That doesn't really make sense. What if you simply claim to encrypt it twice, but instead place random noise wherever the "encrypted for gov't" data should be? If the system works as intended, it shouldn't be possible to attempt decrypting it (and thus verify if you encrypted it properly) without a search warrant based on probable cause, as the key material would be in escrow and not accessible to anybody including law enforcement and intelligence agencies before a warrant is served. So you can't have proactive detection of that and everybody who wants to ecrypt communications with criminal intent can and will continue to do so with the same consequences as right now, where they can be pressured to reveal the keys but their communications are otherwise secure; the process would risk the privacy of honest citizens (in case if the escrow system is broken) but not hamper the bad guys at all.
ska 7y ago
> Why can't we have both security as well as court ordered access? Because "we've" spent decades trying to figure out a method that will actually work, and universally failed?
dredmorbius 7y ago
Maths doesn't work that way. Universal escrow == universal access. Leaking == global compromise. There's a place for personal recovery key quorums, where multiple parts are joined to create an alternate recovery key, but that involves key management for each such key served, which is a Very Large Problem. Might be possible to take it on, but the underlying problem of identity remains: The question "who are you?" is the most expensive one in information technology. No matter how you get it wrong, you're fucked. Deny access to the right party: fucked. Allow access to the wrong party: fucked. The only advantage of security-based DoS over security-based unintended dislosure is that denied access doesn't propogate. Published data cannot be unpublished, at least not at any reasonable cost:assurance level. Because of the key management issues, most seriously-proposed data-backdoor systems revolve around one or more of: - Workfactor reduction in which known keys or values are used in key generation. The resulting keys are weak where the known inputs' secret elements are known, at least to state-leve actors. - Specific escrow keys. No workfactor, just key access. Widespread key access is a Very Bad Day. - Specified access accounts. Like above, but worse. - Specific system bypass. Alternate paths to data access on systems. - Alternate data submission. Various "phone home" or intercepts of in-the-clear transmisions, either through design or software/device compromise. As a practical matter, alternate information channels (usually metadata), public data, standard detection, bug/zeroday exploitation, and various sideband attacks (Maginot compromise: don't go through, go around) tend to be used, though cryptographic attacks have some utility.

jjoonathan 7y ago

These people couldn't stop the OPM database -- blackmail on all of their sensitive personnel -- from getting hacked, and that's something they wanted to protect. Now imagine how good a job they would do of protecting something they resented, like the escrow mechanism in your proposal. Yeah.

LocalPCGuy 7y ago

And when one of those keys gets out? (Which will happen)

RcouF1uZ4gsC 7y ago
The whole point of an HSM is that those keys cannot get out.
- w3rhn2j34oh5o 7y ago
  The point, yes, but it is not the case in reality: 2015: https://cryptosense.com/blog/the-untold-story-of-pkcs11-hsm-vulnerabilities/ https://cryptosense.com/blog/the-untold-story-of-pkcs11-hsm-... 2017: https://cryptosense.com/blog/infineon-rsa-key-generation-bug-how-the-attack-works-and-what-to-do/ https://cryptosense.com/blog/infineon-rsa-key-generation-bug... 2019: https://cryptosense.com/blog/how-ledger-hacked-an-hsm/ https://cryptosense.com/blog/how-ledger-hacked-an-hsm/ Stop trying to build scenarios where key escrow solutions are technically sound. They are not. This is an intractable problem that is not solved by these half cocked technical measures. Key escrow cannot by definition be secure, and wasting time trying to invent solutions just confuses the matter, weakens security and leaves us all vulnerable. Basically, Sssssssh, or the politicians might actually believe this fantasy.
- zeveb 7y ago
  The HSM can get out, by being stolen.
- ska 7y ago
  > The whole point of an HSM is that those keys cannot get out. On paper, sure. In practice, not so much.
- readams 7y ago
  There is basically no limit to the amount of money that it would be worth paying for a government to get those HSMs, since they could decrypt nearly all the world's communication. And the country in which they are hosted is included in the threat model. I would not want to be the one tasked with attempting to keep it secure.

DuskStar 7y ago

Assuming those keys are truly secure, two reasons: 1. No one trusts the government not to abuse such a power. "Only usable with a valid court order" my ass. 2. The government doesn't trust citizens not to change around the escrow keys used (which would prevent them from decrypting things)

mabbo 7y ago
"a valid court order" is an impossible task. Courts are run by judges, who are human and subject to bribing, blackmail, or being wrong.

Analemma_ 7y ago

Once the United States has a backdoor key, every other nation will demand one as well, and there won't be any grounds to refuse. Which creates two problems: - Obviously you can't reuse the same master key, so now you need 180+ keys, meaning 180+ backdoors into the system. It is ridiculous to expect that all of these will remain secure; the United States can't even secure the OPM database so even ours will probably be leaked, and countries with more bribe-prone law enforced will give it up even faster, and now everyone is pwned. - Law enforcement are frequently the bad guys. YMMV on how often this is the case in the United States but it's certainly inarguably the case in many places abroad. Mandatory backdoors means no possibility for secure communications about dissidents and "inconvenients" in those countries.

akersten 7y ago

No, I would not call that secure communication, because it can be accessed by someone other than the intended recipient. The number of hoops they have to jump through is irrelevant. It is not possible to have secure by definition communication and facilitate a backdoor at the same time. The two concepts are strictly mutually exclusive. In the United States you have the amazing freedom to communicate in any language you desire (including one unintelligible to a would-be snoop), and the State cannot force you to translate your communications just because they want to hear them. We should not be so eager to give up that freedom in our digital lives.

rubinelli 7y ago
I'm surprised that Americans aren't pushing to make private and secure communication a constitutional right. Will it make it harder for law enforcement to go after "bad guys"? Yes. Just as the second, fourth, and fifth amendments do today.
- gizmo686 7y ago
  The US classifies encryption as a munition. I am genuinly suprised there hasn't been a push to get it covered under the second amendment.
  - vorpalhex 7y ago
    "Sir, you're going to need an ID, a fingerprint card, and approval from the FBI before you can download that browser."
  - bitwize 7y ago
    Crypto is munitions for export purposes, I doubt you can get a ruling that it qualifies for 2A protection. The law is like that. The law can classify a thing as one thing for one purpose, and another thing for another purpose. If they want to ban crypto, they could classify it as a Schedule I drug and it'd make about as much sense as classifying it as a munition.
  - homonculus1 7y ago

zzzcpan 7y ago

> but still allow legitimate law enforcement searches when ordered by a judge You can already do that by voluntarily providing access to your devices to anyone you want, including law enforcement. Other people don't necessarily share your ideology and accept that there could exist "legitimate law enforcement searches" of their private communications.

throw0101a 7y ago

> Why can't we have both security as well as court ordered access. Waterboarding was treated as a crime by the US during WW2: * https://en.wikipedia.org/wiki/Waterboarding#World_War_II https://en.wikipedia.org/wiki/Waterboarding#World_War_II And then conveniently it was not a crime after 9/11: * https://en.wikipedia.org/wiki/Waterboarding#Classification_in_the_U.S https://en.wikipedia.org/wiki/Waterboarding#Classification_i.... Access to the escrowed keys may also be conveniently reclassified in the future. And that assumes that the law is even followed: you can't trust that the "court ordered access" will remain only court ordered. Law enforcement agencies have violated laws in the past as a matter of policy: * https://en.wikipedia.org/wiki/COINTELPRO https://en.wikipedia.org/wiki/COINTELPRO

GordonS 7y ago

It's a slippery slope - there would undoubtedly be a creeping escalation, with more and more agencies and people given access, and the requirements to get access relaxed. Before you know it, the CIA is hoovering up everything, local police departments have unfettered access and the local environmental agency can easily request access to anything for "reasons". Governments have shown time and again that they abuse any power they get - I wouldn't trust them with this.

Znafon 7y ago

If reading the message require those 5 HSM, how does your recipient can read your message?

wmf 7y ago
You encrypt the message twice so that either the intended recipient or the government with 5 HSMs can decrypt it.
- w3rhn2j34oh5o 7y ago
  Or whomever has hacked the source control / build environment to replace the "5 magic HSM public keys" with one or more of their own public keys -- See Juniper Incident with Dual-EC DRBG (https://eprint.iacr.org/2016/376.pdf https://eprint.iacr.org/2016/376.pdf) This story should be repeated whenever anyone brings up 'solutions' involved with key escrow. Bruce warned us in 2006 this was a backdoor, ten years later, we find that not only was it implemented by Juniper, the backdoor was backdoored by unknown (and potentially malicious) actors. Really, this should be the last word on why this key escrow and general cryptographic backdoors are a terrible terrible idea.
  - Spivak 7y ago
    Entity that compromised a system completely and can read the unencrypted messages... can read the unencrypted messages? In other news giving someone root access to your machine gives them root access.
- PeterisP 7y ago
  That doesn't really make sense. What if you simply claim to encrypt it twice, but instead place random noise wherever the "encrypted for gov't" data should be? If the system works as intended, it shouldn't be possible to attempt decrypting it (and thus verify if you encrypted it properly) without a search warrant based on probable cause, as the key material would be in escrow and not accessible to anybody including law enforcement and intelligence agencies before a warrant is served. So you can't have proactive detection of that and everybody who wants to ecrypt communications with criminal intent can and will continue to do so with the same consequences as right now, where they can be pressured to reveal the keys but their communications are otherwise secure; the process would risk the privacy of honest citizens (in case if the escrow system is broken) but not hamper the bad guys at all.

ska 7y ago

> Why can't we have both security as well as court ordered access? Because "we've" spent decades trying to figure out a method that will actually work, and universally failed?

dredmorbius 7y ago

Maths doesn't work that way. Universal escrow == universal access. Leaking == global compromise. There's a place for personal recovery key quorums, where multiple parts are joined to create an alternate recovery key, but that involves key management for each such key served, which is a Very Large Problem. Might be possible to take it on, but the underlying problem of identity remains: The question "who are you?" is the most expensive one in information technology. No matter how you get it wrong, you're fucked. Deny access to the right party: fucked. Allow access to the wrong party: fucked. The only advantage of security-based DoS over security-based unintended dislosure is that denied access doesn't propogate. Published data cannot be unpublished, at least not at any reasonable cost:assurance level. Because of the key management issues, most seriously-proposed data-backdoor systems revolve around one or more of: - Workfactor reduction in which known keys or values are used in key generation. The resulting keys are weak where the known inputs' secret elements are known, at least to state-leve actors. - Specific escrow keys. No workfactor, just key access. Widespread key access is a Very Bad Day. - Specified access accounts. Like above, but worse. - Specific system bypass. Alternate paths to data access on systems. - Alternate data submission. Various "phone home" or intercepts of in-the-clear transmisions, either through design or software/device compromise. As a practical matter, alternate information channels (usually metadata), public data, standard detection, bug/zeroday exploitation, and various sideband attacks (Maginot compromise: don't go through, go around) tend to be used, though cryptographic attacks have some utility.