3 ms·

Such a secret key would be very valuable and it's almost inevitable that someone with access to it will be willing to sell it to criminals for the sort of money

Such a secret key would be very valuable and it's almost inevitable that someone with access to it will be willing to sell it to criminals for the sort of money those criminals will be able to acquire with it.

tzs 7y ago
> Such a secret key would be very valuable and it's almost inevitable that someone with access to it will be willing to sell it to criminals for the sort of money those criminals will be able to acquire with it Wouldn't a similar argument apply to the secret keys at the roots of Microsoft's and Apple's and many other organization's code signing systems? And the secret keys at the root of SSL security? We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret.
- toast0 7y ago
  A difference is that all of these private roots are subject to market acceptance, and the owners have strong incentives to keep the keys secure. If Microsoft or Apple leak their keys, they at least will spend a lot of effort on cycling keys to their huge number of deployed products and on the PR fallout. If it's managed poorly, they may lose customers. If the US leaks their key, tough noogies, it's mandated to use that one. Companies, much less people, will find it hard to move to another country with better key management procedures.
- Silhouette 7y ago
  We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret. I'm not sure that's true. We might tolerate that situation in specific circumstances where we haven't identified any better choice, but that isn't the same as thinking everything is OK. For example, in the case of certificates used for things like downloading web content over HTTPS, the centralised nature of the CAs and the track record where not all CAs have proved to be trustworthy is a significant concern in the industry. This remains the case even though browsers can revoke the root for any CA that is compromised and despite the increasing use of mitigations like perfect forward secrecy. The rise of Let's Encrypt in particular has been a boon for moving smaller sites to serving over HTTPS by default, but given how many sites now rely on it, it also creates a huge single point of failure in the security infrastructure of the web. Notwithstanding the precautions taken by the operators to keep the most important secrets secret, if anyone hostile did ever manage to compromise that infrastructure covertly, that would be catastrophic for security on the web.
- Symmetry 7y ago
  In theory yes but Microsoft and Apple only ever use the key to sign updates in one point in a regular process. That means the number of people with access to the system can be very small. This both means that you're less likely to have someone corruptible involved and that it's possible to figure out who spilled the key after the fact and punish them. If a government escrow key was kept in a two rooms with air-gapped computers, one on either coast, and anybody hoping to decrypt messages will have to mail it on CD there and get a CD with the decrypted messages mailed back. I could see that system actually keeping the key secret. But proponents of the need for key escrow argue that existing decryption techniques are too slow and inconvenient I don't think that they would be satisfied with this solution. So I'd expect that anyone on the IT team at any of the FBI's 50 or so field offices to be able to get access to the key and so for it to leak in short order.
  - zmmmmm 7y ago
    > argue that existing decryption techniques are too slow and inconvenient I don't think that they would be satisfied with this solution This goes to the heart of the real issue and argument that I think is more powerful ultimately, though it is harder to express. Authorities argue that they are not getting anything new because they always used to have the ability to intercept phone calls, open mail etc. So they argue that interception of encrypted messaging is just "status quo". But it is NOT status quo, because being able to do it at large scale, using automation, sophisticated data analysis and with an overall order of magnitude less effort actually changes the fundamental nature of it altogether. The powerful argument to me is to use a judo-style move where opponents of intercepted messaging actually embrace the "status-quo" argument but then use that to re-establish the same high threshold for that interception that used to exist. For example, if the authorities want access to a specific communication stream, then they should have to involve the messaging provider and they should have to get a one-time key that is set to expire or scoped in some way to specific messages, and they should have to concede to limitations on how secretly that can be done. The most powerful argument of all is that anything that is more invasive will foster a huge ecosystem of end-to-end encrypted services. Encryption is ultimately mathematics and you can't stop people using it. The best you can hope for is to create something that is close enough to OK with everybody that the ecosystem doesn't grow because most people don't care.

tzs 7y ago

> Such a secret key would be very valuable and it's almost inevitable that someone with access to it will be willing to sell it to criminals for the sort of money those criminals will be able to acquire with it Wouldn't a similar argument apply to the secret keys at the roots of Microsoft's and Apple's and many other organization's code signing systems? And the secret keys at the root of SSL security? We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret.

toast0 7y ago
A difference is that all of these private roots are subject to market acceptance, and the owners have strong incentives to keep the keys secure. If Microsoft or Apple leak their keys, they at least will spend a lot of effort on cycling keys to their huge number of deployed products and on the PR fallout. If it's managed poorly, they may lose customers. If the US leaks their key, tough noogies, it's mandated to use that one. Companies, much less people, will find it hard to move to another country with better key management procedures.
Silhouette 7y ago
We've already apparently decided that it is OK to rest our security on the idea that careful organizations can keep secret keys secret. I'm not sure that's true. We might tolerate that situation in specific circumstances where we haven't identified any better choice, but that isn't the same as thinking everything is OK. For example, in the case of certificates used for things like downloading web content over HTTPS, the centralised nature of the CAs and the track record where not all CAs have proved to be trustworthy is a significant concern in the industry. This remains the case even though browsers can revoke the root for any CA that is compromised and despite the increasing use of mitigations like perfect forward secrecy. The rise of Let's Encrypt in particular has been a boon for moving smaller sites to serving over HTTPS by default, but given how many sites now rely on it, it also creates a huge single point of failure in the security infrastructure of the web. Notwithstanding the precautions taken by the operators to keep the most important secrets secret, if anyone hostile did ever manage to compromise that infrastructure covertly, that would be catastrophic for security on the web.
Symmetry 7y ago
In theory yes but Microsoft and Apple only ever use the key to sign updates in one point in a regular process. That means the number of people with access to the system can be very small. This both means that you're less likely to have someone corruptible involved and that it's possible to figure out who spilled the key after the fact and punish them. If a government escrow key was kept in a two rooms with air-gapped computers, one on either coast, and anybody hoping to decrypt messages will have to mail it on CD there and get a CD with the decrypted messages mailed back. I could see that system actually keeping the key secret. But proponents of the need for key escrow argue that existing decryption techniques are too slow and inconvenient I don't think that they would be satisfied with this solution. So I'd expect that anyone on the IT team at any of the FBI's 50 or so field offices to be able to get access to the key and so for it to leak in short order.
- zmmmmm 7y ago
  > argue that existing decryption techniques are too slow and inconvenient I don't think that they would be satisfied with this solution This goes to the heart of the real issue and argument that I think is more powerful ultimately, though it is harder to express. Authorities argue that they are not getting anything new because they always used to have the ability to intercept phone calls, open mail etc. So they argue that interception of encrypted messaging is just "status quo". But it is NOT status quo, because being able to do it at large scale, using automation, sophisticated data analysis and with an overall order of magnitude less effort actually changes the fundamental nature of it altogether. The powerful argument to me is to use a judo-style move where opponents of intercepted messaging actually embrace the "status-quo" argument but then use that to re-establish the same high threshold for that interception that used to exist. For example, if the authorities want access to a specific communication stream, then they should have to involve the messaging provider and they should have to get a one-time key that is set to expire or scoped in some way to specific messages, and they should have to concede to limitations on how secretly that can be done. The most powerful argument of all is that anything that is more invasive will foster a huge ecosystem of end-to-end encrypted services. Encryption is ultimately mathematics and you can't stop people using it. The best you can hope for is to create something that is close enough to OK with everybody that the ecosystem doesn't grow because most people don't care.