5 ms·

> Either they are secure and no-one has a back door that can compromise them, or they are not and anyone could have a back door that can compromise them, but th

by zmmmmm 7y ago

> Either they are secure and no-one has a back door that can compromise them, or they are not and anyone could have a back door that can compromise them, but there is no middle ground where only a politician's preferred government agents have a back door Can you clarify? Wouldn't just having a second key which the government keeps in escrow in case they need to decrypt a message achieve exactly what you are saying is impossible? (Note: I don't agree with the laws being created to undermine encryption ... but I think it undermines the argument against it to overstate the case.)

pfortuny 7y ago
Who oversees the escrow? What are “reasonable uses” of said key? Etc...
Silhouette 7y ago
Wouldn't just having a second key which the government keeps in escrow in case they need to decrypt a message achieve exactly what you are saying is impossible? How would that work? A basic principle of encryption systems is that only relevant parties have access to the secret information. Typically in asymmetric systems they generate their own private key or other secret and never share it with anyone. Moreover, techniques like perfect forward secrecy rely on generating new session keys at each step. As soon as you mandate a systemic backdoor where someone else's secret can be used to unlock anything, you have undermined the whole premise of the system and created a huge single point of failure. Not only that, but normally if there is any concern that a key has been compromised then you can change it to at least continue to protect future communications. With this sort of back door, any compromise is permanent. If you think that's not a serious risk and governments could be trusted to keep such an important back door key secure, let me first ask you this: which government(s) should have access to that key? What happens when, say, someone in the US has family in Iran, and the governments of the US and Iran both insist on being able to intercept messages between them? What happens if a more authoritarian government is elected in Australia and a more liberal one in Canada, and the Five Eyes agreement collapses? Don't forget that a large part of the reason there is so much public debate about these issues today is because someone walked out of the most powerful intelligence agency in the world with the modern equivalent of a note of its deepest secrets in his back pocket and then shared that note with the world.
- zmmmmm 7y ago
  > How would that work? A basic principle of encryption systems is that only relevant parties have access to the secret information. Well, the government is now one of the relevant parties. It doesn't change anything fundamental about the encryption. It just adds the government as a party. I get that you think that is bad (and I do too), that you don't trust the government. But it doesn't break the encryption, that keeps working perfectly, just like it did before. Just more parties have access. The problem here is so many people are going around arguing against this by saying it "breaks" or "backdoors" encryption. And all those people are being completely ignored because the government is getting perfectly reasonable advice that says that it isn't breaking anything.
  - Silhouette 7y ago
    Which government is now a party? All of them? In the entire world? In any case, I don't know how to explain this without getting into a lot of technical details, but introducing an extra party who can read everything like that does fundamentally change the nature of the system. If you want a system where data is encrypted such that two independent parties can each decrypt it using only their own secrets, how do you think key exchange, encryption and decryption would work?
  - u801e 7y ago
    > But it doesn't break the encryption, that keeps working perfectly, just like it did before. Just more parties have access. And if the government's private key has been leaked? How many parties will have access then?
    - coldcode 7y ago
      All of them.
  - cesarb 7y ago
    > Well, the government is now one of the relevant parties. It doesn't change anything fundamental about the encryption. It does change something fundamental: now you have three parties instead of two. Take for instance the most popular key agreement protocol, Diffie–Hellman, and suppose Alice wants to use it to send a message to Bob. When the only parties are Alice and Bob, she can do some calculations with her public key and Bob's public key, and then she has the shared key to be used to encrypt and authenticate the message; these calculations can be done fully offline. If you try to add a third party (George), not only are the calculations more complex, but also they need to be online (all parties have to exchange messages before any party knows the shared key), which makes important use cases harder or impossible. And note that I said above "encrypt and authenticate": possession of the shared key allows one to also forge messages. When there are only two parties, this works fine (Bob knows he hasn't forged anything, so the message can only have come from Alice); with more than two parties, that is no longer the case. That is: the design of a three-party protocol is very different from and much more complex than a two-party protocol. And it gets even more complicated once you want one of the parties to be able to decrypt and validate but not forge messages.
cyphar 7y ago
The problem is that the escrowed key (when it is inevitably leaked) can be used just as easily by people who aren't the government. So even if you trust your government (which, by the way, changes hands every couple of years) the mere existence of an escrow key means that by definition your cryptosystem is not secure against attackers. Personally, if I were an attacker, the first thing I would target is the government's key escrow -- because you can bet your life that will be the weakest point of any cryptosystem with key escrow.
peterkelly 7y ago
One problem (among many) is there's no such thing as "the" government. It's a relative term and its meaning depends on context. If we take it to mean all governments, then that means China gets a copy of the key and can use it to spy on the communications of the Australian government. If we take it to mean just one government (or a few select governments), then what is the criteria for deciding the government of country X should have a key but country Y should not? Ultimately of course it comes down to a matter of coercive power and jurisdiction, which particularly complicates efforts trying to build products or services that are intended for global usage. I believe we need to push back against anti-encryption laws in the west so we have some ground to stand on when making a case that they shouldn't be accepted elsewhere.
- dustinmr 7y ago
  The other problem is that even within one government there isn’t really “the” government. There’s office A and task group X and the prosecutor for this area and that special envoy and this law enforcement agency and that law enforcement agency and various courts, etc, etc, etc. If you haven’t worked much with a large government, you don’t tend to realize just how fractured it all is.
  - ganeshkrishnan 7y ago
    And as someone that consulted for large government organization, the key will be emailed to anyone who needs access. I had access to ssh keys from the project owner for a government contract and the person did not even ask me to delete the keys after the project was over.
    - DataWorker 7y ago
      You probably signed a form saying you would. As long as they have a signed form and you have the keys, everyone is happy. Nothing is really secure anyway, except the stuff that matters.
      - Smoosh 7y ago
Nasrudith 7y ago
It isn't overstating. A key escrow for a country being secure is about as viable as a five year old's plan to run away to disney world with a sippy cup and a bag of snacks. The scale and logistics are wrong and it shows laughable naivety in what it requires of other actors. At this point the anti-encryption spooks and politicians have shown they don't want to listen so reaching them is impossible. The rational debate has been over for decades and we won. Only irrational remains which means it is time to get downright mean. Instead cut them off and discredit them. Show no mercy to the evil fools.
missosoup 7y ago
> Wouldn't just having a second key which the government keeps in escrow Imagine being an outspoken left-wing blogger in America that votes for this. Imagine then Trump gets elected and 'the government' is now an entity that actively breaks established laws and targets outspoken critics. Imagine someone even worse than Trump is elected after that. Imagine the key is leaked. Imagine China makes a trade with your government for your key. There is no taking back that key now, whoever becomes 'the government' at any point in the future has it.
- turk73 7y ago
  I really don't appreciate how you accuse the Trump Admin of doing something that only Democrats have been caught doing. It's like you can't think or something. Who used the IRS to target conservatives? Who ran guns to Mexico in order to create a reason for more gun control laws? Who is using the FBI to subvert the 2016 election? Who indeed.
- redler 7y ago
  The fact that governments change, sometimes radically, is an important point in arguing against escrow. For example, in the current supreme court case R.G. & G.R. Harris Funeral Homes Inc. v. EEOC, the case was brought under the Obama administration BY THE EOC ITSELF, arguing for the plaintiff. Then Trump was elected, and the Department of Justice switched sides -- they now argue against the government's own original case.
turk73 7y ago
It's the same reason why having two kinds of TSA lines is less secure--there's now a second vector of attack! All anyone has to do is become a "Trusted Traveler" and they have less security theater to go through, just send in your info, pay the fee, and off to terrorizing you go. Also, my private data was leaked because of the OPM "hack" which I think was more like the Awan Bros. gave China the passwords to get in. The only reason to want to break encryption is power and control over the masses. There is no "24" scenario that ever happens where people die because some file couldn't be read, that is just Hollywood bullshit.
Symmetry 7y ago
Such a secret key would be very valuable and it's almost inevitable that someone with access to it will be willing to sell it to criminals for the sort of money those criminals will be able to acquire with it.
- tzs 7y ago
  > Such a secret key would be very valuable and it's almost inevitable that someone with access to it will be willing to sell it to criminals for the sort of money those criminals will be able to acquire with it Wouldn't a similar argument apply to the secret keys at the roots of Microsoft's and Apple's and many other organization's code signing systems? And the secret keys at the root of SSL security? We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret.
  - toast0 7y ago
    A difference is that all of these private roots are subject to market acceptance, and the owners have strong incentives to keep the keys secure. If Microsoft or Apple leak their keys, they at least will spend a lot of effort on cycling keys to their huge number of deployed products and on the PR fallout. If it's managed poorly, they may lose customers. If the US leaks their key, tough noogies, it's mandated to use that one. Companies, much less people, will find it hard to move to another country with better key management procedures.
  - Silhouette 7y ago
    We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret. I'm not sure that's true. We might tolerate that situation in specific circumstances where we haven't identified any better choice, but that isn't the same as thinking everything is OK. For example, in the case of certificates used for things like downloading web content over HTTPS, the centralised nature of the CAs and the track record where not all CAs have proved to be trustworthy is a significant concern in the industry. This remains the case even though browsers can revoke the root for any CA that is compromised and despite the increasing use of mitigations like perfect forward secrecy. The rise of Let's Encrypt in particular has been a boon for moving smaller sites to serving over HTTPS by default, but given how many sites now rely on it, it also creates a huge single point of failure in the security infrastructure of the web. Notwithstanding the precautions taken by the operators to keep the most important secrets secret, if anyone hostile did ever manage to compromise that infrastructure covertly, that would be catastrophic for security on the web.
fencepost 7y ago
Wouldn't just having a second key which the government keeps in escrow in case they need to decrypt a message achieve exactly what you are saying is impossible? Others have already pointed out the problems of who has access to that key, I'll simply point out that the system would potentially collapse under its own weight. If there is a single master key then it's a huge risk. If that risk is recognized and there's a way to invalidate and replace that master key then suddenly you have an entire additional infrastructure of communications for key replacement that has to be in place. If you have multiple separate keys generated at the initiation of each encrypted communication, then there has to be a separate secure infrastructure for transmission of the additional key to some government entity. As a side note that potentially secure infrastructure by law probably has to have the same key sharing requirements. You also run into problems with things like embedded systems, and if you don't think that's a problem look back at the problems in the networking stack used in vxworks and other embedded systems that are in the field and effectively unpatchable. Edit: ipnet, URGENT/11, https://www.bleepingcomputer.com/news/security/urgent-11-vxworks-rtos-vulnerabilities-found-critical-systems-affected/ https://www.bleepingcomputer.com/news/security/urgent-11-vxw... Edit2: I forgot to mention, this is an all or nothing decision. If you're mandating this it has to apply to ALL communications or you end up with things shifting channels. Banking transactions? Master key. Medical patient portals? Master key. VPN to the office? Master key. Any secure website connection? Master key. You likely have to make using any non keyed encryption illegal with severe penalties, and you have to devise a system in which it's possible to identify encrypted communications not encrypted with that key without that key being available.
LocalH 7y ago
What happens if that escrowed key becomes compromised?
SkyBelow 7y ago
Beyond the existing answers, also look at how existing records are stored. You can use FOIA to get the keys needed to unlock access to government weapon stores (Defcon had presenters who talked about this). How many times have governments been hacked and had financial data stolen; that could have just as easily been some of those keys.

by zmmmmm 7y ago

pfortuny 7y ago

Who oversees the escrow? What are “reasonable uses” of said key? Etc...

Silhouette 7y ago

Wouldn't just having a second key which the government keeps in escrow in case they need to decrypt a message achieve exactly what you are saying is impossible? How would that work? A basic principle of encryption systems is that only relevant parties have access to the secret information. Typically in asymmetric systems they generate their own private key or other secret and never share it with anyone. Moreover, techniques like perfect forward secrecy rely on generating new session keys at each step. As soon as you mandate a systemic backdoor where someone else's secret can be used to unlock anything, you have undermined the whole premise of the system and created a huge single point of failure. Not only that, but normally if there is any concern that a key has been compromised then you can change it to at least continue to protect future communications. With this sort of back door, any compromise is permanent. If you think that's not a serious risk and governments could be trusted to keep such an important back door key secure, let me first ask you this: which government(s) should have access to that key? What happens when, say, someone in the US has family in Iran, and the governments of the US and Iran both insist on being able to intercept messages between them? What happens if a more authoritarian government is elected in Australia and a more liberal one in Canada, and the Five Eyes agreement collapses? Don't forget that a large part of the reason there is so much public debate about these issues today is because someone walked out of the most powerful intelligence agency in the world with the modern equivalent of a note of its deepest secrets in his back pocket and then shared that note with the world.

zmmmmm 7y ago
> How would that work? A basic principle of encryption systems is that only relevant parties have access to the secret information. Well, the government is now one of the relevant parties. It doesn't change anything fundamental about the encryption. It just adds the government as a party. I get that you think that is bad (and I do too), that you don't trust the government. But it doesn't break the encryption, that keeps working perfectly, just like it did before. Just more parties have access. The problem here is so many people are going around arguing against this by saying it "breaks" or "backdoors" encryption. And all those people are being completely ignored because the government is getting perfectly reasonable advice that says that it isn't breaking anything.
- Silhouette 7y ago
  Which government is now a party? All of them? In the entire world? In any case, I don't know how to explain this without getting into a lot of technical details, but introducing an extra party who can read everything like that does fundamentally change the nature of the system. If you want a system where data is encrypted such that two independent parties can each decrypt it using only their own secrets, how do you think key exchange, encryption and decryption would work?
- u801e 7y ago
  > But it doesn't break the encryption, that keeps working perfectly, just like it did before. Just more parties have access. And if the government's private key has been leaked? How many parties will have access then?
  - coldcode 7y ago
    All of them.
- cesarb 7y ago
  > Well, the government is now one of the relevant parties. It doesn't change anything fundamental about the encryption. It does change something fundamental: now you have three parties instead of two. Take for instance the most popular key agreement protocol, Diffie–Hellman, and suppose Alice wants to use it to send a message to Bob. When the only parties are Alice and Bob, she can do some calculations with her public key and Bob's public key, and then she has the shared key to be used to encrypt and authenticate the message; these calculations can be done fully offline. If you try to add a third party (George), not only are the calculations more complex, but also they need to be online (all parties have to exchange messages before any party knows the shared key), which makes important use cases harder or impossible. And note that I said above "encrypt and authenticate": possession of the shared key allows one to also forge messages. When there are only two parties, this works fine (Bob knows he hasn't forged anything, so the message can only have come from Alice); with more than two parties, that is no longer the case. That is: the design of a three-party protocol is very different from and much more complex than a two-party protocol. And it gets even more complicated once you want one of the parties to be able to decrypt and validate but not forge messages.

cyphar 7y ago

The problem is that the escrowed key (when it is inevitably leaked) can be used just as easily by people who aren't the government. So even if you trust your government (which, by the way, changes hands every couple of years) the mere existence of an escrow key means that by definition your cryptosystem is not secure against attackers. Personally, if I were an attacker, the first thing I would target is the government's key escrow -- because you can bet your life that will be the weakest point of any cryptosystem with key escrow.

peterkelly 7y ago

One problem (among many) is there's no such thing as "the" government. It's a relative term and its meaning depends on context. If we take it to mean all governments, then that means China gets a copy of the key and can use it to spy on the communications of the Australian government. If we take it to mean just one government (or a few select governments), then what is the criteria for deciding the government of country X should have a key but country Y should not? Ultimately of course it comes down to a matter of coercive power and jurisdiction, which particularly complicates efforts trying to build products or services that are intended for global usage. I believe we need to push back against anti-encryption laws in the west so we have some ground to stand on when making a case that they shouldn't be accepted elsewhere.

dustinmr 7y ago
The other problem is that even within one government there isn’t really “the” government. There’s office A and task group X and the prosecutor for this area and that special envoy and this law enforcement agency and that law enforcement agency and various courts, etc, etc, etc. If you haven’t worked much with a large government, you don’t tend to realize just how fractured it all is.
- ganeshkrishnan 7y ago
  And as someone that consulted for large government organization, the key will be emailed to anyone who needs access. I had access to ssh keys from the project owner for a government contract and the person did not even ask me to delete the keys after the project was over.
  - DataWorker 7y ago
    You probably signed a form saying you would. As long as they have a signed form and you have the keys, everyone is happy. Nothing is really secure anyway, except the stuff that matters.
    - Smoosh 7y ago

Nasrudith 7y ago

It isn't overstating. A key escrow for a country being secure is about as viable as a five year old's plan to run away to disney world with a sippy cup and a bag of snacks. The scale and logistics are wrong and it shows laughable naivety in what it requires of other actors. At this point the anti-encryption spooks and politicians have shown they don't want to listen so reaching them is impossible. The rational debate has been over for decades and we won. Only irrational remains which means it is time to get downright mean. Instead cut them off and discredit them. Show no mercy to the evil fools.

missosoup 7y ago

> Wouldn't just having a second key which the government keeps in escrow Imagine being an outspoken left-wing blogger in America that votes for this. Imagine then Trump gets elected and 'the government' is now an entity that actively breaks established laws and targets outspoken critics. Imagine someone even worse than Trump is elected after that. Imagine the key is leaked. Imagine China makes a trade with your government for your key. There is no taking back that key now, whoever becomes 'the government' at any point in the future has it.

turk73 7y ago
I really don't appreciate how you accuse the Trump Admin of doing something that only Democrats have been caught doing. It's like you can't think or something. Who used the IRS to target conservatives? Who ran guns to Mexico in order to create a reason for more gun control laws? Who is using the FBI to subvert the 2016 election? Who indeed.
redler 7y ago
The fact that governments change, sometimes radically, is an important point in arguing against escrow. For example, in the current supreme court case R.G. & G.R. Harris Funeral Homes Inc. v. EEOC, the case was brought under the Obama administration BY THE EOC ITSELF, arguing for the plaintiff. Then Trump was elected, and the Department of Justice switched sides -- they now argue against the government's own original case.

turk73 7y ago

It's the same reason why having two kinds of TSA lines is less secure--there's now a second vector of attack! All anyone has to do is become a "Trusted Traveler" and they have less security theater to go through, just send in your info, pay the fee, and off to terrorizing you go. Also, my private data was leaked because of the OPM "hack" which I think was more like the Awan Bros. gave China the passwords to get in. The only reason to want to break encryption is power and control over the masses. There is no "24" scenario that ever happens where people die because some file couldn't be read, that is just Hollywood bullshit.

Symmetry 7y ago

Such a secret key would be very valuable and it's almost inevitable that someone with access to it will be willing to sell it to criminals for the sort of money those criminals will be able to acquire with it.

tzs 7y ago
> Such a secret key would be very valuable and it's almost inevitable that someone with access to it will be willing to sell it to criminals for the sort of money those criminals will be able to acquire with it Wouldn't a similar argument apply to the secret keys at the roots of Microsoft's and Apple's and many other organization's code signing systems? And the secret keys at the root of SSL security? We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret.
- toast0 7y ago
  A difference is that all of these private roots are subject to market acceptance, and the owners have strong incentives to keep the keys secure. If Microsoft or Apple leak their keys, they at least will spend a lot of effort on cycling keys to their huge number of deployed products and on the PR fallout. If it's managed poorly, they may lose customers. If the US leaks their key, tough noogies, it's mandated to use that one. Companies, much less people, will find it hard to move to another country with better key management procedures.
- Silhouette 7y ago
  We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret. I'm not sure that's true. We might tolerate that situation in specific circumstances where we haven't identified any better choice, but that isn't the same as thinking everything is OK. For example, in the case of certificates used for things like downloading web content over HTTPS, the centralised nature of the CAs and the track record where not all CAs have proved to be trustworthy is a significant concern in the industry. This remains the case even though browsers can revoke the root for any CA that is compromised and despite the increasing use of mitigations like perfect forward secrecy. The rise of Let's Encrypt in particular has been a boon for moving smaller sites to serving over HTTPS by default, but given how many sites now rely on it, it also creates a huge single point of failure in the security infrastructure of the web. Notwithstanding the precautions taken by the operators to keep the most important secrets secret, if anyone hostile did ever manage to compromise that infrastructure covertly, that would be catastrophic for security on the web.

fencepost 7y ago

Wouldn't just having a second key which the government keeps in escrow in case they need to decrypt a message achieve exactly what you are saying is impossible? Others have already pointed out the problems of who has access to that key, I'll simply point out that the system would potentially collapse under its own weight. If there is a single master key then it's a huge risk. If that risk is recognized and there's a way to invalidate and replace that master key then suddenly you have an entire additional infrastructure of communications for key replacement that has to be in place. If you have multiple separate keys generated at the initiation of each encrypted communication, then there has to be a separate secure infrastructure for transmission of the additional key to some government entity. As a side note that potentially secure infrastructure by law probably has to have the same key sharing requirements. You also run into problems with things like embedded systems, and if you don't think that's a problem look back at the problems in the networking stack used in vxworks and other embedded systems that are in the field and effectively unpatchable. Edit: ipnet, URGENT/11, https://www.bleepingcomputer.com/news/security/urgent-11-vxworks-rtos-vulnerabilities-found-critical-systems-affected/ https://www.bleepingcomputer.com/news/security/urgent-11-vxw... Edit2: I forgot to mention, this is an all or nothing decision. If you're mandating this it has to apply to ALL communications or you end up with things shifting channels. Banking transactions? Master key. Medical patient portals? Master key. VPN to the office? Master key. Any secure website connection? Master key. You likely have to make using any non keyed encryption illegal with severe penalties, and you have to devise a system in which it's possible to identify encrypted communications not encrypted with that key without that key being available.

LocalH 7y ago

What happens if that escrowed key becomes compromised?

SkyBelow 7y ago

Beyond the existing answers, also look at how existing records are stored. You can use FOIA to get the keys needed to unlock access to government weapon stores (Defcon had presenters who talked about this). How many times have governments been hacked and had financial data stolen; that could have just as easily been some of those keys.