7 ms·

Serious question (about practicality, not ethics): people always say that it's impossible to provide government access to encrypted data without opening a huge

• free_rms 6y ago
  That's exactly it, it's very possible, but all the eggs would be in one basket. Scheme: multiple copies of symmetric key followed by symmetrically encrypted body (pgp-style). One copy of the symmetric key is secured by user's private key, another is wrapped in an onion of all required "side" keys. The issue is that the government-held keys only need to be exposed once, and then someone has a key to all of everything, everywhere.
  • slg 6y ago
    They mentioned having multiple keys with different government organizations. What if there are 12 keys and you need 6 keys to decrypt the data. The user has 6 keys. The company that created the device or service has 2 keys, the judicial branch has 2 keys, and the executive branch has 2 keys. All of the non-user keys are required to be in different systems. The compromise of any one system still requires cooperation from the non-user groups to decrypt. You couple that with some system that allows the data to be decrypted and reencrypted with new keys in the case of a breech of keys. You can add as many keys to this scenario as you want until you feel like a breech of the necessary number of keys is not going to happen. Are we sure a system along these lines is impossible?
    • dwheeler 6y ago
      Unfortunately, each key will be poorly protected, because each group will rationalize that "it would be impossible for someone to get all those keys" while someone gets all the keys. The US government couldn't even keep the most sensitive information about its personnel secret, see the OPM breach: https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... The Inspector General had warned Congress of "persistent deficiencies in OPM's information system security program" and nothing was done. This resulted in some really sensitive data being exfiltrated, probably some good blackmail info. The US government has not done a great job even protecting its own employees. The biggest problem here, though, is incentives. A government cannot be sued, or suffer any other negative impact, if it accidentally loses keys that lead to others' death, blackmail, or job loss. Too bad, so sad. If tomorrow it becomes illegal or unacceptable to do something that today is legal, a government can retroactively punish those who engaged in it. In short, the government has no strong incentive to protect the keys, only you do.
      • slg 6y ago
        It sounds like we have already moved from this is an impossible request to this is a difficult and impractical request. Setting up a government competition with a prize to solve a hard problem seems reasonable.
        • unionpivo 6y ago
          > It sounds like we have already moved from this is an impossible request to this is a difficult and impractical request. I am not sure how you got this from conversation above. Still sounds impossible to me. Problem as stated is, that if skeleton keys are broken, then everything everywhere gets broken. The fact that government has bad initiatives to keep keys secret, just means it will be easier for bad actors to steal them. But that is just a side argument.
          • slg 6y ago
            >I am not sure how you got this from conversation above. Still sounds impossible to me. When discussing encryption, many people say that this is an impossible problem to solve because of math. This conversation has shifted to being a problem about incentives. Math is impossible to change. Incentives are changeable. If the only problems here are the specifics of the scheme and the incentives of people involved, those are solvable. >Problem as stated is, that if skeleton keys are broken, then everything everywhere gets broken. Which is why you build redundancy into the system that would require multiple independent breaches and a system to reencrypt data in the event of a breach.
  • suizi 6y ago
    Modern security involves generating a key for every session and this could be dicey with a master key.
    • free_rms 6y ago
      Yeah, that's the symmetric key in this scheme, I should have said session key.
• RHSeeger 6y ago
  > Of course the data would still be hackable if a bad actor were to get their hands on both of those keys, but security could be increased by, for example, increasing the number of parties needed to authorize the access. Not "if", "when". It will happen, and as soon as it does, everyone's privacy (for previously encrypted content) is gone forever. It is impossible for me (and I think a lot of other people) to imagine the government can keep those keys secret for a reasonable period of time, nonetheless forever.
• shakna 6y ago
  > So that something like the combination of a judicial private key and an fbi private key were required to access the data? Because, eventually, they'll leak. Security and intelligence agencies have lost keys and hacking tools and top security documents. And when they leak, the surface for what you can exfiltrate before the keys are rolled over will be _everything_. If you can roll over the key. Microsoft leaked their Secure Boot key once, and it wasn't possible for them to fix that on all of their devices. Whilst that isn't a particularly concerning leak, that changes if what it was protecting becomes someone's personal information. To protect against a leak that compromises everyone, everywhere, you'd want the government keys to be unique per site and company. Which would also incidentally make securing those keys harder and lead to more leaks. And that's before you question whether the people with access to the keys are actually trustworthy and won't do what law enforcement have done in the past, like stalk their ex. It's a no-win situation.
  • umvi 6y ago
    > Because, eventually, they'll leak. All of them will leak? Seems like if each key is in possession of a different party, and you need all keys to decrypt, and at least a few are air-gapped only available for warrant holders via manual retrieval... the probability would be vanishingly small. I agree it's impossible in theory, but in reality nobody has put out significant resources and made an honest effort to try, imo. I bet I could come up with an encryption scheme that allows decryption for warrant holders only, but the scheme to decrypt will be very onerous for the warrant holder and will require manual retrieval of air-gapped asymmetric keys and lengthy background checks to establish trust (i.e. is this person who they say they are and did the judge really grant a warrant, etc.).
    • lozaning 6y ago
      And I bet I'd not use it. You can add whatever extra bureaucratic processes you want, but you're still making my encrypted data less secure.
    • paulryanrogers 6y ago
      There was that government OPN hack not so long ago with all that gov PII. And consider the tempting target these keys will make for state actors.
• toast0 6y ago
  The problem is the only way this is trustworthy is if you require signoff from either 4 or all 5 of the permanent members of the UN Security council. That's the only existing agency I would trust to be sufficiently adversarial to ensure reasonable privacy.
  • jchrisa 6y ago
    What if each person got to choose 5 trusted friends?
    • bawolff 6y ago
      Can i choose /dev/null as my 5 friends?
      • dane-pgp 6y ago
        The 5 friends probably have to be distinct, but you might get away with using symlinks.
• rectang 6y ago
  Algorithmically speaking, Shamir's Secret Sharing seems of interest to your "combination of private keys" option. • https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing • https://cs.jhu.edu/~sdoshi/crypto/papers/shamirturing.pdf https://cs.jhu.edu/~sdoshi/crypto/papers/shamirturing.pdf I agree with the sibling commentators though that it just isn't strong enough to withstand a threat model of "people motivated to get the master key to vast amounts of encrypted communication". Even if such a scheme couldn't be cracked algorithmically, it wouldn't hold up against the relentless social engineering efforts that would be thrown at it.
  • jonny_eh 6y ago
    > people motivated to get the master key Or, more likely, people charged with protecting the master key being negligent. One of potentially many examples: https://www.renderlab.net/advisories/mta-key/ https://www.renderlab.net/advisories/mta-key/
• disappearance 6y ago
  Important to remember the government itself might be the worst actor. Trump busy doing favours for Saudi Arabia who murder & hack up a reporter. Imagine the favours if he had access to those keys via his corrupt DOJ. Terrifying.
• mdxn 6y ago
  Encryption keys do not have to give "all or nothing" access to encrypted material. With homomorphic encryption and related primitives, you can shape things in a much more finer grained manner and only expose carefully crafted partial information. This can accomplish what you are hoping for with your threshold cryptography example without relying on some sort of combined trust built from multiple authorized parties. For instance, with functional encryption, you are able to distribute or derive keys that have a very specific functional purpose and leaks no other information. Basically it allows you to derive a "function key" that basically computes f(x) for you given an encryption of x. As long as the crypto is strong, no other information about x is exposed (only info about f(x) is revealed). With the right system architecture, this would allow the government to perform a very specific, pre-defined query to check for illegal content without exposing any additional information about the encrypted data. Another approach you could use is based on zero-knowledge proofs and verifiable computation. Essentially a government could come along and ask you to provide a proof that your encrypted data does not contain malicious content. Given a program that can check for what they are looking for, you can provide them a zero-knowledge proof that convinces them that you correctly ran their provided algorithm on the suspect data and that the algorithm did not identify any malicious content. In this process, no other bits of information are exposed or handed to the government other than the data is not malicious.
  • bawolff 6y ago
    All of this presupposes you can create an algorithm that can "check" if something is illegal. That seems impossible if you have to define the algorithm before the crime is comitted, and honestly still pretty difficult even if you know what specificly you are looking for.
    • viraptor 6y ago
      It's why the antivirus industry exists despite continuously failing. They're pretty much fighting that impossible battle every day.
• cmurf 6y ago
  Key fragments are managed by which governments? And it would differ from the U.N. Security Council, how? Probably it would be Five Eyes rather than the WWII surviving super powers? But back then they were more on the same page than today, so in 10 years or 50 years, the one key to rule them all countries likely don't still get along either. I think it just devolves into an espionage race to acquire all the fragments. Or breaking the code.
• dragonwriter 6y ago
  > Why couldn't an encryption scheme be used that, for decryption, requires either a) the user's private key (a usual), or b) some sort of combination of private keys of all the relevant government entities required to authorize accessing the user's data? It maybe be technically possible to make such a scheme, but due to the unitary executive, keys split among N government agencies have the same essential practical security as 1 key held by one counterparty, and one counterparty that has no particular interest in the security of your data. So this fails the “preserves security” aspect for the same reason that any system that enables government access must.
• suizi 6y ago
  It's been tried before. It was cracked so badly they never tried it again.
• tathougies 6y ago
  There is an even more advanced solution: homomorphic encryption lets you operate over fully-encrypted, undecryptable data, and compute new derived data from it that -- if decrypted with the same key -- is as if the computation was done over the decrypted version to begin with. This can be used to create 'blind' machine learning computer vision models that can detect objects in encrypted data but still can't actually 'see' what's going on.
  • wiredfool 6y ago
    I thought that was in the realm of theoretically possible but 1e-10 x as efficient?
• OminousWeapons 6y ago
  Others have correctly pointed out the threat presented by key loss. I would like to add that I don't trust the government to properly follow the law once they have the keys. If law enforcement, the justice department, or intelligence agencies hold the key then the only things stopping abuse are administrative controls. That's not acceptable to me as we have seen repeated bypass of administrative controls from all 3 of these groups. The only acceptable solution would be to have the data holders control the keys and process law enforcement requests for data, and then you still have to worry about key loss or theft of keys by intelligence agencies. A far simpler solution to this problem would be to change the law to mandate disclosure of encryption keys / passwords if served with a warrant. I don't agree with this either, but at least it's more elegant than what is being proposed.
  • suizi 6y ago
    What if someone throws away the keys or forgets their password?
    • novok 6y ago
      What if the house with all the evidence burns down and all of it is unusable ashes?
      • suizi 6y ago
        Can you do that at the press of a button ahead of time?
      • suizi 6y ago
        What if the government goes pursuing old crimes (or divine something that points to you) and you don't remember the password?
    • OminousWeapons 6y ago
      You could show that they accessed a device or used a service immediately prior to being subject to litigation (through network logs for example). A judge would not believe the person didn't remember the password in this case. If they destroyed the keys after receiving a request for data then that would be destruction of evidence which is already punishable. If the data is held by a third party then the third party could perform a password reset.
• lalaithion 6y ago
  A lot of attacks on cryptosystems involve things such as being able to encrypt whatever you want with the private key, being able to generate lots of messages encrypted with the private key, or being able to observe the errors that occur when decrypting a slightly wrong encrypted message. By allowing anyone to encrypt a file to the government's private key, you're vastly increasing the chances that one of these attacks goes from infeasable to easily doable. Right now, if someone were to find a chosen plaintext attack on AES, they could find someone who will encrypt things with their key, get them to encrypt the chosen plaintext, and then break other things that person had encrypted. If we used the proposed system, then the chosen plaintext attack would allow me to encrypt the plaintext on my own, and then use it to break everything in the world that was encrypted.
• wonderwonder 6y ago
  Looking at the current political environment where entities that were supposed to act as independent organizations are now all controlled by people actively doing as the president instructs them, how long before some one from each of those organizations with a key are all sitting in a room decrypting the private communications of political enemies?
• deleted 6y ago
  [deleted]