4 ms·

I think we need to come up with solutions to problems like key escrow (i.e. in Signal's case) that don't require trusted computing because a single root of trus

I think we need to come up with solutions to problems like key escrow (i.e. in Signal's case) that don't require trusted computing because a single root of trust for hardware is a single point of failure and depends on trusting the hardware manufacturer. There are a lot of possibilities with distributed computing

josh2600 7y ago
Do you have any narrative of how to do key recovery safely without an enclave or a human in the loop? I’ve spent a lot of time thinking about this and I don’t really know how to do it without one of those two things. Edit: like I hear you saying there are possibilities in a distributed computing world, but I don’t have any idea what distributed computing enables for key recovery (except possibly k of n schemes but that’s just replication, not safety). Edit 2: also, presume that users suck at key management and can’t remember long password strings, 24 words, or be trusted to store a key for a meaningful period of time.
- lxgr 7y ago
  It would still be an enclave of sorts, but white box cryptography is generally trying to achieve a similar goal as trusted computing, without relying on trusted hardware.
  - josh2600 7y ago
    I don’t think the enclave you’re describing exists, nor do I believe there is an enclave that is untrusted hardware. Do you have an example of such an enclave and how it would operate without a remote attention service in the model where a user can trust that a distributed network they don’t control is safeguarding their key?
    - sounds 7y ago
      If homomorphic encryption advances to the point where it's usable, that would be an example of security on untrusted hardware. (But I suppose that just proves your point.)
      - josh2600 7y ago
        Yes. I think if homomorphic encryption existed in a way that was super fast, we would be using that. It’s real far as far as I can tell.
        girvo 7y ago
        It's definitely real, but as you stated, incredibly slow (and noisy, though that's dealt with by refreshing). It has limitations currently, but there's good work right now lifting those, so it's definitely something to keep an eye on moving forward.
AlexCoventry 7y ago
> like key escrow (i.e. in Signal's case) Is signal moving towards some sort of key escrow policy?
darkmighty 7y ago
There is a solution: Fully Homomorphic Encryption (FHE). However, it's unfortunately not practical yet with current hardware (and it's unclear if it will ever be). Meanwhile some partially homomorphic schemes might address specific applications (say for instance a 3rd party provides an encrypted list, I believe there are nearly-practical algorithms to sort this encrypted list information leaks). Trusted platforms are pretty interesting IMO in their ability to essentially provide FHE by means of tamper-resistance instead of mathematical security. Objections should be more directed at the control of keys being with Intel; maybe some other orgs should be in charge, maybe there could be a number of trust vendors you could choose, or at least veto (and allow external users of your external platform to choose). Something more in line with TLS authentication: we all need to trust 3rd parties to use the internet, and nobody protests -- with good reason. It's a well designed, open, decentralized system with good oversight.

josh2600 7y ago

Do you have any narrative of how to do key recovery safely without an enclave or a human in the loop? I’ve spent a lot of time thinking about this and I don’t really know how to do it without one of those two things. Edit: like I hear you saying there are possibilities in a distributed computing world, but I don’t have any idea what distributed computing enables for key recovery (except possibly k of n schemes but that’s just replication, not safety). Edit 2: also, presume that users suck at key management and can’t remember long password strings, 24 words, or be trusted to store a key for a meaningful period of time.

lxgr 7y ago
It would still be an enclave of sorts, but white box cryptography is generally trying to achieve a similar goal as trusted computing, without relying on trusted hardware.
- josh2600 7y ago
  I don’t think the enclave you’re describing exists, nor do I believe there is an enclave that is untrusted hardware. Do you have an example of such an enclave and how it would operate without a remote attention service in the model where a user can trust that a distributed network they don’t control is safeguarding their key?
  - sounds 7y ago
    If homomorphic encryption advances to the point where it's usable, that would be an example of security on untrusted hardware. (But I suppose that just proves your point.)
    - josh2600 7y ago
      Yes. I think if homomorphic encryption existed in a way that was super fast, we would be using that. It’s real far as far as I can tell.
      - girvo 7y ago
        It's definitely real, but as you stated, incredibly slow (and noisy, though that's dealt with by refreshing). It has limitations currently, but there's good work right now lifting those, so it's definitely something to keep an eye on moving forward.

AlexCoventry 7y ago

> like key escrow (i.e. in Signal's case) Is signal moving towards some sort of key escrow policy?

darkmighty 7y ago

There is a solution: Fully Homomorphic Encryption (FHE). However, it's unfortunately not practical yet with current hardware (and it's unclear if it will ever be). Meanwhile some partially homomorphic schemes might address specific applications (say for instance a 3rd party provides an encrypted list, I believe there are nearly-practical algorithms to sort this encrypted list information leaks). Trusted platforms are pretty interesting IMO in their ability to essentially provide FHE by means of tamper-resistance instead of mathematical security. Objections should be more directed at the control of keys being with Intel; maybe some other orgs should be in charge, maybe there could be a number of trust vendors you could choose, or at least veto (and allow external users of your external platform to choose). Something more in line with TLS authentication: we all need to trust 3rd parties to use the internet, and nobody protests -- with good reason. It's a well designed, open, decentralized system with good oversight.