4 ms·

Wouldn't just having a second key which the government keeps in escrow in case they need to decrypt a message achieve exactly what you are saying is impossible?

Wouldn't just having a second key which the government keeps in escrow in case they need to decrypt a message achieve exactly what you are saying is impossible? How would that work? A basic principle of encryption systems is that only relevant parties have access to the secret information. Typically in asymmetric systems they generate their own private key or other secret and never share it with anyone. Moreover, techniques like perfect forward secrecy rely on generating new session keys at each step. As soon as you mandate a systemic backdoor where someone else's secret can be used to unlock anything, you have undermined the whole premise of the system and created a huge single point of failure. Not only that, but normally if there is any concern that a key has been compromised then you can change it to at least continue to protect future communications. With this sort of back door, any compromise is permanent. If you think that's not a serious risk and governments could be trusted to keep such an important back door key secure, let me first ask you this: which government(s) should have access to that key? What happens when, say, someone in the US has family in Iran, and the governments of the US and Iran both insist on being able to intercept messages between them? What happens if a more authoritarian government is elected in Australia and a more liberal one in Canada, and the Five Eyes agreement collapses? Don't forget that a large part of the reason there is so much public debate about these issues today is because someone walked out of the most powerful intelligence agency in the world with the modern equivalent of a note of its deepest secrets in his back pocket and then shared that note with the world.

zmmmmm 7y ago
> How would that work? A basic principle of encryption systems is that only relevant parties have access to the secret information. Well, the government is now one of the relevant parties. It doesn't change anything fundamental about the encryption. It just adds the government as a party. I get that you think that is bad (and I do too), that you don't trust the government. But it doesn't break the encryption, that keeps working perfectly, just like it did before. Just more parties have access. The problem here is so many people are going around arguing against this by saying it "breaks" or "backdoors" encryption. And all those people are being completely ignored because the government is getting perfectly reasonable advice that says that it isn't breaking anything.
- Silhouette 7y ago
  Which government is now a party? All of them? In the entire world? In any case, I don't know how to explain this without getting into a lot of technical details, but introducing an extra party who can read everything like that does fundamentally change the nature of the system. If you want a system where data is encrypted such that two independent parties can each decrypt it using only their own secrets, how do you think key exchange, encryption and decryption would work?
- u801e 7y ago
  > But it doesn't break the encryption, that keeps working perfectly, just like it did before. Just more parties have access. And if the government's private key has been leaked? How many parties will have access then?
  - coldcode 7y ago
    All of them.
- cesarb 7y ago
  > Well, the government is now one of the relevant parties. It doesn't change anything fundamental about the encryption. It does change something fundamental: now you have three parties instead of two. Take for instance the most popular key agreement protocol, Diffie–Hellman, and suppose Alice wants to use it to send a message to Bob. When the only parties are Alice and Bob, she can do some calculations with her public key and Bob's public key, and then she has the shared key to be used to encrypt and authenticate the message; these calculations can be done fully offline. If you try to add a third party (George), not only are the calculations more complex, but also they need to be online (all parties have to exchange messages before any party knows the shared key), which makes important use cases harder or impossible. And note that I said above "encrypt and authenticate": possession of the shared key allows one to also forge messages. When there are only two parties, this works fine (Bob knows he hasn't forged anything, so the message can only have come from Alice); with more than two parties, that is no longer the case. That is: the design of a three-party protocol is very different from and much more complex than a two-party protocol. And it gets even more complicated once you want one of the parties to be able to decrypt and validate but not forge messages.

zmmmmm 7y ago

> How would that work? A basic principle of encryption systems is that only relevant parties have access to the secret information. Well, the government is now one of the relevant parties. It doesn't change anything fundamental about the encryption. It just adds the government as a party. I get that you think that is bad (and I do too), that you don't trust the government. But it doesn't break the encryption, that keeps working perfectly, just like it did before. Just more parties have access. The problem here is so many people are going around arguing against this by saying it "breaks" or "backdoors" encryption. And all those people are being completely ignored because the government is getting perfectly reasonable advice that says that it isn't breaking anything.

Silhouette 7y ago
Which government is now a party? All of them? In the entire world? In any case, I don't know how to explain this without getting into a lot of technical details, but introducing an extra party who can read everything like that does fundamentally change the nature of the system. If you want a system where data is encrypted such that two independent parties can each decrypt it using only their own secrets, how do you think key exchange, encryption and decryption would work?
u801e 7y ago
> But it doesn't break the encryption, that keeps working perfectly, just like it did before. Just more parties have access. And if the government's private key has been leaked? How many parties will have access then?
- coldcode 7y ago
  All of them.
cesarb 7y ago
> Well, the government is now one of the relevant parties. It doesn't change anything fundamental about the encryption. It does change something fundamental: now you have three parties instead of two. Take for instance the most popular key agreement protocol, Diffie–Hellman, and suppose Alice wants to use it to send a message to Bob. When the only parties are Alice and Bob, she can do some calculations with her public key and Bob's public key, and then she has the shared key to be used to encrypt and authenticate the message; these calculations can be done fully offline. If you try to add a third party (George), not only are the calculations more complex, but also they need to be online (all parties have to exchange messages before any party knows the shared key), which makes important use cases harder or impossible. And note that I said above "encrypt and authenticate": possession of the shared key allows one to also forge messages. When there are only two parties, this works fine (Bob knows he hasn't forged anything, so the message can only have come from Alice); with more than two parties, that is no longer the case. That is: the design of a three-party protocol is very different from and much more complex than a two-party protocol. And it gets even more complicated once you want one of the parties to be able to decrypt and validate but not forge messages.