6 ms·

> Cryptographers have maintained that when you create a back door, it is a question of time until it is found and publicized. Why would it not be possible to c

by gist 7y ago

> Cryptographers have maintained that when you create a back door, it is a question of time until it is found and publicized. Why would it not be possible to create a system that required several manual and offline steps in order to break the encryption? For example (and perhaps similar to offline cold storage of bitcoin) why couldn't a system be designed whereby 3 or more people in geographically diverse areas were in a position to agree that a request for information was legitimate (by court order) and thereby produce what is needed to unlock certain information? So one person would not have the key or access. After all right now you have a case where a single person (the owner) is able to unlock information. The feeling is a back door can be hacked. What if it's not a back door though?

btilly 7y ago
Shamir secret sharing allows for that on paper. The problem is that to be useful for law enforcement, any local police department has to be able to go to any local judge and get a warrant and then get access. There are approximately 30,000 state judges with fairly high turnover in that list. If you can compromise one, or successfully get yourself added to that list, you can then get access to whatever you want. That's way too many people to trust. This is not a hypothetical weakness. I personally know someone whose physical location was compromised through a court order obtained by bribing a judge. How many cases are there where similar access was gained but the victim doesn't know how it happened? And the better the access that you can get, the more incentive there is to get it. (There is no shortage of reasons why a motivated party would want such access.)
- skybrian 7y ago
  This is basically what happens when law enforcement uses a search warrant to get access to user data from a tech company. While this process does have weaknesses, it is still the difference between a legal process overseen by the courts and one based on espionage where agents do whatever they want without oversight. Note that strong network encryption is essential for ensuring that they have to get a warrant. I don't think anyone has come up with a better system than judicial oversight that still allows law enforcement to do their job?
  - mindslight 7y ago
    > that still allows law enforcement to do their job? Do libraries not keeping records of who has read what books not allow law enforcement to do their job? Do prohibitions against arbitrary searches not allow law enforcement to do their job? Does having to make a plausible argument in front of a judge not allow law enforcement to do their job? Do individuals not having a number tattooed on their forehead not allow law enforcement to do their job? Law enforcement continually frames any pereceived difficulty as if it is prevents them, which is utterly disingenuous. Law enforcement's "job" is to operate within the constraints of a free society composed of innocent people, in spite of the extra work from not being able to just shoot the bad guy like in the movies. When they don't respect this, they're merely another criminal element.
    - ndarwincorn 7y ago
      While I agree with your point, if you're going to critique law enforcement this only goes halfway: In the US, the idea of the publicly funded law enforcement officer can trace its lineage back to antebellum slave catchers. Much like they now (and forever) frame any perceived difficulty as preventing them from doing their job, they've successfully re-framed their role in society as protecting and serving (people) instead of protecting and serving (property rights), despite that obviously not being the case.
      - heartbeats 7y ago
        How is that a good thing though? American police are not very popular, to put it bluntly. Even among the Americans I know who support their efforts, they still do not have any affinity towards individual police officers. Compare this to the situation in Europe and Asia (or at least the civilized parts like Japan), where it's perfectly acceptable and normal to ask a policeman for directions. And where their role is indeed to protect and serve people (not property). "Police have the role of protecting and serving people" really does not feel like such a controversial viewpoint to me.
    - skybrian 7y ago
      You're being too binary about this. Yes, we should be skeptical of law enforcement. Judicial oversight is essential. But we should still care about police effectiveness at catching law breakers. Why have laws if they can't be enforced?
DuskStar 7y ago
Does anything prevent the "offline" bits of your system from working online? Does anything prevent the information there from being compromised? Not "we keep it super duuper safe, we promise", but actual cryptographic guarantees? I think the history of crypto exchange hacks should be of interest here.
js2 7y ago
Key escrow is the term. See this paper from 1997: https://www.cdt.org/wp-content/uploads/pdfs/paper-key-escrow.pdf https://www.cdt.org/wp-content/uploads/pdfs/paper-key-escrow... And this from 2015: https://academic.oup.com/cybersecurity/article/1/1/69/2367066 https://academic.oup.com/cybersecurity/article/1/1/69/236706... See also https://cdt.org/insights/the-nsas-split-key-encryption-proposal-is-not-serious/ https://cdt.org/insights/the-nsas-split-key-encryption-propo...
zentiggr 7y ago
Each of those people would have to do some sort of authentication. Each of those mechanisms is just as subject to accidental disclosure, hacking, etc as any other. Make a door, it won't stay secret. And you can't assure that there won't be bad actors involved in any number of parties that have to agree. The whole backdoor system, once it exists, is open to subversion and/or misuse. The only way to not have the problem is not create the door in the first place.
KorematsuFred 7y ago
Once we all agree that should be a key the government then focuses on just getting the "ease" of obtaining the key. You gotta fight them at every step with an irrational zeal to prevent this slippery slope. Example: None of us case about midget porn. If we all agree that banning midget porn will not have an impact on anyone, government then quickly moves on to octopus porn. Now, on a matter of principle you will find your position weaker and weaker.
lozaning 7y ago
You can safeguard the process the government needs to go through to get approval to decrypt things all you want. That doesn't stop bad actors separate from the government from finding and taking advantages of the vulnerabilities introduced by enabling the government to forcibly decrypt things. Cant fix technology problems with people processes.
- scarface74 7y ago
  You act as if the government isn’t the “bad actor”.
  - lozaning 7y ago
    The point Im trying to make is even if we did trust the government and had full faith that they'd never abuse this power, whatever technical mechanism they'd use to 'rightfully' decrypt things would surely be attempted to be misused by people that are explicitly and exclusively bad actors.
commandlinefan 7y ago
> 3 or more people in geographically diverse areas Sure, a system could be designed where the “master key that unlocks everything” is distributed - that makes the problem of the attacker who wants to get his hands on that key slightly harder, because now he has to compromise three systems instead of one, but that doesn’t change the fundamental risk, which is that he can do that in the first place. Remember, you’re talking about one piece (or three pieces) of information which can be used to decode every single secret in the United States - this isn’t limited by technical feasibility, this is the explicit end goal that you’re asking for. If Russian hackers got a hold of it undetected, they could decrypt everything for a very long time. Even if it were revealed that it were compromised, everything that was encrypted using the old key would have to be re-encrypted somehow, and the old copies destroyed somehow.
- solotronics 7y ago
  I would think the government itself would be exempt from the master key. They would most likely secure their own communications without having these master keys out of the control of the parties communicating. "Good for thee but not for me."
modeless 7y ago
> Why would it not be possible to create a system that required several manual and offline steps No matter what "offline" and "manual" steps you propose, they can be made online and automatic after a one-time compromise of the system. And if a single system is protecting the secrets of literally everyone, the incentive for compromising that system is unlimited. There's no attack too impractical when the stakes are so high.
cvwright 7y ago
Maybe something like this? Judge, Jury & Encryptioner: Exceptional Access with a Fixed Social Cost https://arxiv.org/abs/1912.05620 https://arxiv.org/abs/1912.05620 > We present Judge, Jury and Encryptioner (JJE) an exceptional access scheme for unlocking devices that does not give unilateral power to any single authority and places final approval to unlock in the hands of peer devices. Our scheme, JJE, distributes maintenance of the protocol across a network of "custodians" such as courts, government agencies, civil rights watchdogs and academic institutions. Unlock requests, however, can only be approved by a randomly selected set of unlock delegates, consisting of other peer devices that must be physically located to gain access. This requires that law enforcement expend both human and monetary resources and pay a "fixed social cost" in order to find and request the participation of law abiding citizens in the unlock process.
- cvwright 7y ago
  Another one that the GP poster may find interesting. This is from Stefan Savage at UCSD, and published in ACM CCS in 2018. https://cseweb.ucsd.edu/~savage/papers/lawful.pdf https://cseweb.ucsd.edu/~savage/papers/lawful.pdf Lawful Device Access without Mass Surveillance Risk:A Technical Design Discussion > This paper proposes a systems-oriented design for supporting court-ordered data access to “locked” devices with system-encrypted storage, while explicitly resisting large-scale surveillance use. We describe a design that focuses entirely on passcode self-escrow(i.e., storing a copy of the user passcode into a write-only component on the device) and thus does not require any changes to underlying cryptographic algorithms. Further, by predicating any lawful access on extended-duration physical seizure, we foreclose mass-surveillance use cases while still supporting reasonable investigatory interests. Moreover, by couching per-device authorization protocols with the device manufacturer, this design avoids creating new trusted authorities or organizations while providing particularity (i.e., no “master keys” exist). Finally, by providing a concrete description of one such approach, we hope to encourage further technical consideration of the possibilities and limitations of trade-offs in this design space.
feanaro 7y ago
Apart from what others said, there is also the following problem. People won't like this and will start encrypting traffic with non-compromised algorithms. Given that properly encrypted traffic appears random, how would you enforce the requirement that everyone uses the state-sanctioned, compromised algorithm? In order to check and enforce, you'd have to turn this into an online, warrantless, dragnet-style system, the very thing you were trying to avoid. A contradiction. It's not feasible to ban people from using their own encryption unless you plan on severely restricting their freedom.
- cvwright 7y ago
  Law enforcement likes to talk about big, scary threats like terrorism, because those make the public more likely to accept their position. The article below argues that the real use case for breaking encryption is to catch everyday criminals, not to go after shadowy Bond villains. Would the public still go for it, if they looked at it this way? Probably not... The Encryption Debate Isn't About Stopping Terrorists, It's About Solving Crime https://www.lawfareblog.com/encryption-debate-isnt-about-stopping-terrorists-its-about-solving-crime https://www.lawfareblog.com/encryption-debate-isnt-about-sto... Edit: And most everyday criminals are not technologically savvy. Half of them probably have a hard time using Telegram safely.
- paulryanrogers 7y ago
  > It's not feasible to ban people from using their own encryption unless you plan on severely restricting their freedom. In practice even the tech types weary of using and maintaining truly secure solutions. So if they outlaw backdoor-less solutions then companies won't support them. And without commercial support the options will dwindle. And even donation supported projects like Truecrypt will fold under pressure. Crypto isn't a one-person job
MaulingMonkey 7y ago
> Why would it not be possible to create a system that required several manual and offline steps in order to break the encryption? When done correctly and with everyone's knowledge and consent, this is a form of key escrow. But there's some simple math at play here - the more unlock options there are, the more points of vulnerability and failure. https://haveibeenpwned.com/ https://haveibeenpwned.com/ lists 8 breaches of my data and I'm aware of more they don't list - the industry can't even keep my data under lock and key without adding more points of failure via key escrow as another thing they can fuck up. > For example (and perhaps similar to offline cold storage of bitcoin) why couldn't a system be designed whereby 3 or more people in geographically diverse areas were in a position to agree that a request for information was legitimate (by court order) and thereby produce what is needed to unlock certain information? So one person would not have the key or access. Bitcoin is a great example, in a way - there are several stories out there of exchanges fucking up and losing access to their coins or having their coins stolen, even when they were using cold storage. All 3 people will likely be duped by the same fradulent (or just overreaching) LEO email, in part because of the all too human tendency for each of them to assume that "one of the other two would have caught it if it was fishy, right?" > After all right now you have a case where a single person (the owner) is able to unlock information. The feeling is a back door can be hacked. What if it's not a back door though? The label you use doesn't matter - the more people who can unlock things, the more points of failure you have, and the more likely things will end up hacked. The industry struggles enough to secure things even when it takes a hard line approach and espouses end-to-end encryption. Defending against abuse by insiders/employees usually means going through a bunch of trouble to lock your own employees out of customer data - or making it unavailable to the company in the first place - not giving them more tools to access it. Governments already have more than enough tools to completely pwn my privacy if they actually need to. Convince a judge to sign a sneak and peek warrant, have law enforcement covertly install a hardware keylogger, and I'd wager you'll pwn most people - even if they're tech savy. But that requires pesky things like indivudalized suspicion, "checks and balances", actual work, and involving multiple people (your landlord or a locksmith for the keys or entry access, your security company to silence the alarms, a judge to sign off on the warrant and a leo to execute it) so it's harder to run a long term secret warrantless suspicionless mass surveilance dragnet as a rogue employee or agency. But not impossible, as certain three letter agencies have shown.
Canada 7y ago
No, it's not possible to create such a system without fatally compromising safety. Take Bitcoin cold storage: People use offline storage and specialized hardware wallets to store their keys more safely. Now imagine there were some privileged keys that would allow the holder to just take anyone and everyone's bitcoins. It doesn't matter how geographically distributed it is, how elaborate the key ceremonies and oversight is. The system could never be trusted if such a backdoor existed.

by gist 7y ago

btilly 7y ago

Shamir secret sharing allows for that on paper. The problem is that to be useful for law enforcement, any local police department has to be able to go to any local judge and get a warrant and then get access. There are approximately 30,000 state judges with fairly high turnover in that list. If you can compromise one, or successfully get yourself added to that list, you can then get access to whatever you want. That's way too many people to trust. This is not a hypothetical weakness. I personally know someone whose physical location was compromised through a court order obtained by bribing a judge. How many cases are there where similar access was gained but the victim doesn't know how it happened? And the better the access that you can get, the more incentive there is to get it. (There is no shortage of reasons why a motivated party would want such access.)

skybrian 7y ago
This is basically what happens when law enforcement uses a search warrant to get access to user data from a tech company. While this process does have weaknesses, it is still the difference between a legal process overseen by the courts and one based on espionage where agents do whatever they want without oversight. Note that strong network encryption is essential for ensuring that they have to get a warrant. I don't think anyone has come up with a better system than judicial oversight that still allows law enforcement to do their job?
- mindslight 7y ago
  > that still allows law enforcement to do their job? Do libraries not keeping records of who has read what books not allow law enforcement to do their job? Do prohibitions against arbitrary searches not allow law enforcement to do their job? Does having to make a plausible argument in front of a judge not allow law enforcement to do their job? Do individuals not having a number tattooed on their forehead not allow law enforcement to do their job? Law enforcement continually frames any pereceived difficulty as if it is prevents them, which is utterly disingenuous. Law enforcement's "job" is to operate within the constraints of a free society composed of innocent people, in spite of the extra work from not being able to just shoot the bad guy like in the movies. When they don't respect this, they're merely another criminal element.
  - ndarwincorn 7y ago
    While I agree with your point, if you're going to critique law enforcement this only goes halfway: In the US, the idea of the publicly funded law enforcement officer can trace its lineage back to antebellum slave catchers. Much like they now (and forever) frame any perceived difficulty as preventing them from doing their job, they've successfully re-framed their role in society as protecting and serving (people) instead of protecting and serving (property rights), despite that obviously not being the case.
    - heartbeats 7y ago
      How is that a good thing though? American police are not very popular, to put it bluntly. Even among the Americans I know who support their efforts, they still do not have any affinity towards individual police officers. Compare this to the situation in Europe and Asia (or at least the civilized parts like Japan), where it's perfectly acceptable and normal to ask a policeman for directions. And where their role is indeed to protect and serve people (not property). "Police have the role of protecting and serving people" really does not feel like such a controversial viewpoint to me.
  - skybrian 7y ago
    You're being too binary about this. Yes, we should be skeptical of law enforcement. Judicial oversight is essential. But we should still care about police effectiveness at catching law breakers. Why have laws if they can't be enforced?

DuskStar 7y ago

Does anything prevent the "offline" bits of your system from working online? Does anything prevent the information there from being compromised? Not "we keep it super duuper safe, we promise", but actual cryptographic guarantees? I think the history of crypto exchange hacks should be of interest here.

js2 7y ago

Key escrow is the term. See this paper from 1997: https://www.cdt.org/wp-content/uploads/pdfs/paper-key-escrow.pdf https://www.cdt.org/wp-content/uploads/pdfs/paper-key-escrow... And this from 2015: https://academic.oup.com/cybersecurity/article/1/1/69/2367066 https://academic.oup.com/cybersecurity/article/1/1/69/236706... See also https://cdt.org/insights/the-nsas-split-key-encryption-proposal-is-not-serious/ https://cdt.org/insights/the-nsas-split-key-encryption-propo...

zentiggr 7y ago

Each of those people would have to do some sort of authentication. Each of those mechanisms is just as subject to accidental disclosure, hacking, etc as any other. Make a door, it won't stay secret. And you can't assure that there won't be bad actors involved in any number of parties that have to agree. The whole backdoor system, once it exists, is open to subversion and/or misuse. The only way to not have the problem is not create the door in the first place.

KorematsuFred 7y ago

Once we all agree that should be a key the government then focuses on just getting the "ease" of obtaining the key. You gotta fight them at every step with an irrational zeal to prevent this slippery slope. Example: None of us case about midget porn. If we all agree that banning midget porn will not have an impact on anyone, government then quickly moves on to octopus porn. Now, on a matter of principle you will find your position weaker and weaker.

lozaning 7y ago

You can safeguard the process the government needs to go through to get approval to decrypt things all you want. That doesn't stop bad actors separate from the government from finding and taking advantages of the vulnerabilities introduced by enabling the government to forcibly decrypt things. Cant fix technology problems with people processes.

scarface74 7y ago
You act as if the government isn’t the “bad actor”.
- lozaning 7y ago
  The point Im trying to make is even if we did trust the government and had full faith that they'd never abuse this power, whatever technical mechanism they'd use to 'rightfully' decrypt things would surely be attempted to be misused by people that are explicitly and exclusively bad actors.

commandlinefan 7y ago

> 3 or more people in geographically diverse areas Sure, a system could be designed where the “master key that unlocks everything” is distributed - that makes the problem of the attacker who wants to get his hands on that key slightly harder, because now he has to compromise three systems instead of one, but that doesn’t change the fundamental risk, which is that he can do that in the first place. Remember, you’re talking about one piece (or three pieces) of information which can be used to decode every single secret in the United States - this isn’t limited by technical feasibility, this is the explicit end goal that you’re asking for. If Russian hackers got a hold of it undetected, they could decrypt everything for a very long time. Even if it were revealed that it were compromised, everything that was encrypted using the old key would have to be re-encrypted somehow, and the old copies destroyed somehow.

solotronics 7y ago
I would think the government itself would be exempt from the master key. They would most likely secure their own communications without having these master keys out of the control of the parties communicating. "Good for thee but not for me."

modeless 7y ago

> Why would it not be possible to create a system that required several manual and offline steps No matter what "offline" and "manual" steps you propose, they can be made online and automatic after a one-time compromise of the system. And if a single system is protecting the secrets of literally everyone, the incentive for compromising that system is unlimited. There's no attack too impractical when the stakes are so high.

cvwright 7y ago

Maybe something like this? Judge, Jury & Encryptioner: Exceptional Access with a Fixed Social Cost https://arxiv.org/abs/1912.05620 https://arxiv.org/abs/1912.05620 > We present Judge, Jury and Encryptioner (JJE) an exceptional access scheme for unlocking devices that does not give unilateral power to any single authority and places final approval to unlock in the hands of peer devices. Our scheme, JJE, distributes maintenance of the protocol across a network of "custodians" such as courts, government agencies, civil rights watchdogs and academic institutions. Unlock requests, however, can only be approved by a randomly selected set of unlock delegates, consisting of other peer devices that must be physically located to gain access. This requires that law enforcement expend both human and monetary resources and pay a "fixed social cost" in order to find and request the participation of law abiding citizens in the unlock process.

cvwright 7y ago
Another one that the GP poster may find interesting. This is from Stefan Savage at UCSD, and published in ACM CCS in 2018. https://cseweb.ucsd.edu/~savage/papers/lawful.pdf https://cseweb.ucsd.edu/~savage/papers/lawful.pdf Lawful Device Access without Mass Surveillance Risk:A Technical Design Discussion > This paper proposes a systems-oriented design for supporting court-ordered data access to “locked” devices with system-encrypted storage, while explicitly resisting large-scale surveillance use. We describe a design that focuses entirely on passcode self-escrow(i.e., storing a copy of the user passcode into a write-only component on the device) and thus does not require any changes to underlying cryptographic algorithms. Further, by predicating any lawful access on extended-duration physical seizure, we foreclose mass-surveillance use cases while still supporting reasonable investigatory interests. Moreover, by couching per-device authorization protocols with the device manufacturer, this design avoids creating new trusted authorities or organizations while providing particularity (i.e., no “master keys” exist). Finally, by providing a concrete description of one such approach, we hope to encourage further technical consideration of the possibilities and limitations of trade-offs in this design space.

feanaro 7y ago

Apart from what others said, there is also the following problem. People won't like this and will start encrypting traffic with non-compromised algorithms. Given that properly encrypted traffic appears random, how would you enforce the requirement that everyone uses the state-sanctioned, compromised algorithm? In order to check and enforce, you'd have to turn this into an online, warrantless, dragnet-style system, the very thing you were trying to avoid. A contradiction. It's not feasible to ban people from using their own encryption unless you plan on severely restricting their freedom.

cvwright 7y ago
Law enforcement likes to talk about big, scary threats like terrorism, because those make the public more likely to accept their position. The article below argues that the real use case for breaking encryption is to catch everyday criminals, not to go after shadowy Bond villains. Would the public still go for it, if they looked at it this way? Probably not... The Encryption Debate Isn't About Stopping Terrorists, It's About Solving Crime https://www.lawfareblog.com/encryption-debate-isnt-about-stopping-terrorists-its-about-solving-crime https://www.lawfareblog.com/encryption-debate-isnt-about-sto... Edit: And most everyday criminals are not technologically savvy. Half of them probably have a hard time using Telegram safely.
paulryanrogers 7y ago
> It's not feasible to ban people from using their own encryption unless you plan on severely restricting their freedom. In practice even the tech types weary of using and maintaining truly secure solutions. So if they outlaw backdoor-less solutions then companies won't support them. And without commercial support the options will dwindle. And even donation supported projects like Truecrypt will fold under pressure. Crypto isn't a one-person job

MaulingMonkey 7y ago

> Why would it not be possible to create a system that required several manual and offline steps in order to break the encryption? When done correctly and with everyone's knowledge and consent, this is a form of key escrow. But there's some simple math at play here - the more unlock options there are, the more points of vulnerability and failure. https://haveibeenpwned.com/ https://haveibeenpwned.com/ lists 8 breaches of my data and I'm aware of more they don't list - the industry can't even keep my data under lock and key without adding more points of failure via key escrow as another thing they can fuck up. > For example (and perhaps similar to offline cold storage of bitcoin) why couldn't a system be designed whereby 3 or more people in geographically diverse areas were in a position to agree that a request for information was legitimate (by court order) and thereby produce what is needed to unlock certain information? So one person would not have the key or access. Bitcoin is a great example, in a way - there are several stories out there of exchanges fucking up and losing access to their coins or having their coins stolen, even when they were using cold storage. All 3 people will likely be duped by the same fradulent (or just overreaching) LEO email, in part because of the all too human tendency for each of them to assume that "one of the other two would have caught it if it was fishy, right?" > After all right now you have a case where a single person (the owner) is able to unlock information. The feeling is a back door can be hacked. What if it's not a back door though? The label you use doesn't matter - the more people who can unlock things, the more points of failure you have, and the more likely things will end up hacked. The industry struggles enough to secure things even when it takes a hard line approach and espouses end-to-end encryption. Defending against abuse by insiders/employees usually means going through a bunch of trouble to lock your own employees out of customer data - or making it unavailable to the company in the first place - not giving them more tools to access it. Governments already have more than enough tools to completely pwn my privacy if they actually need to. Convince a judge to sign a sneak and peek warrant, have law enforcement covertly install a hardware keylogger, and I'd wager you'll pwn most people - even if they're tech savy. But that requires pesky things like indivudalized suspicion, "checks and balances", actual work, and involving multiple people (your landlord or a locksmith for the keys or entry access, your security company to silence the alarms, a judge to sign off on the warrant and a leo to execute it) so it's harder to run a long term secret warrantless suspicionless mass surveilance dragnet as a rogue employee or agency. But not impossible, as certain three letter agencies have shown.

Canada 7y ago

No, it's not possible to create such a system without fatally compromising safety. Take Bitcoin cold storage: People use offline storage and specialized hardware wallets to store their keys more safely. Now imagine there were some privileged keys that would allow the holder to just take anyone and everyone's bitcoins. It doesn't matter how geographically distributed it is, how elaborate the key ceremonies and oversight is. The system could never be trusted if such a backdoor existed.