4 ms·

Maths means you can't deal with this. Sorry. You only get two choices: 1. Secure legal communication that no-one can break. 2. A ban on strong non-backdoored e

Maths means you can't deal with this. Sorry. You only get two choices: 1. Secure legal communication that no-one can break. 2. A ban on strong non-backdoored encryption, where the backdoor keys will be misused and leaked to criminals. Meanwhile, criminals can just keep using secure illegal communication that no-one can break. Maths means that you don't get to choose a position in-between these two choices.

jlokier 6y ago
Maths actually doesn't agree with you. It is possible to construct end-to-end strongly encrypted systems with a backdoor that is governed by a strong social consensus process. For example, Shamir secret sharing to split the backdoor key among a group of parties that you respect in aggregate. If, say, 50% of those parties agree that you've been a particularly awful criminal they might vote that your nefarious chat should be opened up for the authorities to examine, by contributing their key fragments. All sorts of social consensus protocols can be built, with arbitrary rules. Probably most of them aren't such a good idea, but math does allow it. These days we would probably use a blockchain and smart contracts to provide very strong barriers against leakage. Imagine the key fragments locked inside a smart contract that only gives out the key when N anonymous decision makers concur that the key should be given out, as well as deciding to whom it should be given. In some zero-knowledge protocols it would not even be possible to find out who voted, only the result. It is also possible, in ideal maths world, to design systems where an AI trawls through private conversations but can only reveal information if certain conditions are detected. That sounds a bit dark, but if the conditions are also governed by social consensus processes perhaps that isn't so bad. For example if the AI is instructed (by social consensus, not authoritarians) "only extract a network of conversations if they show a clear pattern of $ParticularlyAwfulCrime, otherwise leave people to their privacy" perhaps that isn't so bad. We don't have the technology to do that now, but we may get it eventually; math is not the obstacle.
- Nasrudith 6y ago
  That has so many wrong assumptions. First off the assumption that there is a group trusted in aggregate. If I trusted them they would have been party to it in the first place! Second the logistics of it are "clever dick" as opposed to a real solution - like suggesting using one off Hoffman encoding to compress a large file to only 1 bit. Third - blockchain to protect against leakage? That is the exact opposite of its job. Buzzwords aren't magic spells.
  - jlokier 6y ago
    Your #1: Your trust is irrelevant when discussing whether mnw21cam's list is complete, as your trust was not part of the criteria. (That said, on trust "If I trusted them they would have been party to it in the first place!" doesn't make sense. There's a huge difference between wanting to share all your content with a group of people all the time, versus trusting those people to make a collective decision to release your documents, for example when they agree that you have died. People are seriously examining this sort of mechanism now because it's relevant to modern life. For example releasing your password and accounts store to family or trusted friends upon your death or incapacitation, using some kind of distributed dead man's switch that needs human judgement to confirm.) The fact is, mnw21cam's statement that there are only two possible branches because of maths, depends on the assumption that keys "will be leaked" being inevitable. A sibling commenter believes it is inevitable they will be leaked no matter how sophisticated an aggregation mechanism is used. That is a reasonable argument, though one I disagree with. If you have a threat model strong enough to break the distributed consensus mechanism of things like Ethereum, then you have a threat model that invalidates branch 1 in mnw21cam's list as well as branch 2, so you cannot win: Under that model, you cannot have "secure legal communication that no-one can break" because your own device is vulnerable to compromise as well. You should find a way to talk without a recording device. Your #2: What I've said is a real logical possibility, and in fact is what we might actually end up with in a number of areas of life. It is not as 'clever dick nonsense' as you think. It might be an undesirable idea, but it is a technically possible one. Your #3: Yes blockchains store and publicise. They also implement strong distributed consensus, and on top of those other things are layered, such as Ethereum-style smart contracts, and zero-knowledge calculations. If you think those cannot be used to control the release of fragmented or encrypted secrets driven by measurements of human decisions, you haven't understood them yet. I really recommend you look at ZKProof.org, and have a think about how privacy-maintaining blockchain coins like Zcash and Monero are able to use a public blockchain to exchange secret transactions. Note: I have no stake in this, I'm not a cryptocurrency or blockchain fan particularly. But I do understand how they work, and I'm not fooled by the buzzwords (at all, I'm quite skeptical).
- teddyh 6y ago
  > they might vote that your nefarious chat should be opened up You are implicitly assuming that this is the only way that the chats can be decrypted. This is only true until the keys are compromised. And the keys will be compromised, because: 1. The keys are worth a lot to the right people. 2. The parties which have the keys have no real incentive to secure the keys well. 3. There is no way for an party with a key to become aware that the key has been compromised. 1, 2, and 3 will combine into a state of the world in which the keys are always compromised.
  - jlokier 6y ago
    I think 2 and 3 are incorrect under my scheme. If parties host key fragments themselves, unencrypted, then I'd agree with both 2 and 3. However if the keys are encrypted in such a way that parties can only decrypt them by posting confirmation to a blockchain (or equivalent), two things occur: 2a. The parties have a very strong incentive to secure their transaction-posting-keys, because those are the same keys as they use to protect their own other valuable assets such as cryptocurrency, or whatever else they are securing these days such as DAO governance. Some people will be sloppy (and lose their own money and other things), but on a large scale, perhaps it's an open question so far how many people will be that sloppy. If it's not too many people, the system is not compromised. 3a. Any party will become aware their own transaction-posting-key is used as soon as they see a transaction under their identity posted to the blockchain they participate in. They can also see how it's used. I've said blockchain but it doesn't actually need a blockchain. If there is one, it can be private or public. Either way, 2a and 3a apply. The main thing is there is an agreed "consensus location" into which people can choose whether to pool enough information to reconstitute the originally protected conversation key, with their only unencrypted secret being their multi-use key they are strongly incentivised to guard (2a), and to which they will only post if they can detect when it's used and limit how it's used (3a).
    - teddyh 6y ago
      Those do sound like reasonable design decisions, but in practice the systems which are eventually actually implemented are basically never as well-designed as that.
- c1ccccc1 6y ago
  Some interesting thoughts here, but the issue of the key leaking is still a problem with your proposed protocol. After the first time all these trusted parties come together and reveal the key, someone still has to actually take the key and decrypt the relevant message. After that point, the key exists in plaintext, and it will be very difficult to ensure that it remains secret. Same problem with giving the key only to an AI: The AI needs the key, and it will be difficult to ensure that the AI system isn't hacked, especially if it's the kind of large distributed system that would be required to process everyone's messages. What you're looking for is a protocol where N parties have to agree in order to decrypt any given message, and agreement to decrypt a particular message doesn't allow them to decrypt any other messages. Here's one that might accomplish that (disclaimer: I am not a cryptographer): - People can use whatever end to end encryption scheme they like to send their messages, but they must Shamir-split the key into N parts, and send those parts to the relevant authorities. - We can check that people are obeying this protocol without violating their privacy by the following method: Every time someone sends a message, they xor it with a string of random bits. Then they send it in 2 parts: the xored message, and the original string of random bits. The original message can only be reconstructed from both parts. Each part is sent with a separate key. The N authorities randomly choose one of the two parts to open. They then check that it decrypts properly (messages will include a hash of the contents, so that this is easily checkable, and difficult to fake). - Of course, people may not trust the authorities to only decrypt one of their message pair. The solution to this is that the list of N authorities is always the same, except for the last one: this is a choice server. People can use whatever choice server they like. However, all choice servers are required to be auditable by both the government and the public. It's the choice server's job to (1) randomly choose 1 message from each pair to decrypt, (2) not release the Shamir-fragment for the key to the other message unless given a warrant by a judge. Of course, this will be inconvenient, imperfect, and add a heck of a lot of overhead. Some choice servers will be found to be corrupt either in favour of the intelligence agencies, or the criminals, having managed to hide their corruptness from audits. It also will not stop determined criminals from using their own encryption. It's not all that easy to tell when people are sending encrypted messages to each other, the messages will just look like random bits. There are plenty of places in perfectly innocuous seeming messages to hide random bits. They could even be hidden as noise added to a particular image. A random-bit-hiding arms race is one that cipher-users are inevitably going to win.
tzs 6y ago
Given the existence of end-to-end strong encrypted group chat systems, it is trivial to construct something between your #1 and #2. Simply use end-to-end strong encrypted group chat and require that when a user creates a new chat room that they invite a government agent into the room.

jlokier 6y ago

Maths actually doesn't agree with you. It is possible to construct end-to-end strongly encrypted systems with a backdoor that is governed by a strong social consensus process. For example, Shamir secret sharing to split the backdoor key among a group of parties that you respect in aggregate. If, say, 50% of those parties agree that you've been a particularly awful criminal they might vote that your nefarious chat should be opened up for the authorities to examine, by contributing their key fragments. All sorts of social consensus protocols can be built, with arbitrary rules. Probably most of them aren't such a good idea, but math does allow it. These days we would probably use a blockchain and smart contracts to provide very strong barriers against leakage. Imagine the key fragments locked inside a smart contract that only gives out the key when N anonymous decision makers concur that the key should be given out, as well as deciding to whom it should be given. In some zero-knowledge protocols it would not even be possible to find out who voted, only the result. It is also possible, in ideal maths world, to design systems where an AI trawls through private conversations but can only reveal information if certain conditions are detected. That sounds a bit dark, but if the conditions are also governed by social consensus processes perhaps that isn't so bad. For example if the AI is instructed (by social consensus, not authoritarians) "only extract a network of conversations if they show a clear pattern of $ParticularlyAwfulCrime, otherwise leave people to their privacy" perhaps that isn't so bad. We don't have the technology to do that now, but we may get it eventually; math is not the obstacle.

Nasrudith 6y ago
That has so many wrong assumptions. First off the assumption that there is a group trusted in aggregate. If I trusted them they would have been party to it in the first place! Second the logistics of it are "clever dick" as opposed to a real solution - like suggesting using one off Hoffman encoding to compress a large file to only 1 bit. Third - blockchain to protect against leakage? That is the exact opposite of its job. Buzzwords aren't magic spells.
- jlokier 6y ago
  Your #1: Your trust is irrelevant when discussing whether mnw21cam's list is complete, as your trust was not part of the criteria. (That said, on trust "If I trusted them they would have been party to it in the first place!" doesn't make sense. There's a huge difference between wanting to share all your content with a group of people all the time, versus trusting those people to make a collective decision to release your documents, for example when they agree that you have died. People are seriously examining this sort of mechanism now because it's relevant to modern life. For example releasing your password and accounts store to family or trusted friends upon your death or incapacitation, using some kind of distributed dead man's switch that needs human judgement to confirm.) The fact is, mnw21cam's statement that there are only two possible branches because of maths, depends on the assumption that keys "will be leaked" being inevitable. A sibling commenter believes it is inevitable they will be leaked no matter how sophisticated an aggregation mechanism is used. That is a reasonable argument, though one I disagree with. If you have a threat model strong enough to break the distributed consensus mechanism of things like Ethereum, then you have a threat model that invalidates branch 1 in mnw21cam's list as well as branch 2, so you cannot win: Under that model, you cannot have "secure legal communication that no-one can break" because your own device is vulnerable to compromise as well. You should find a way to talk without a recording device. Your #2: What I've said is a real logical possibility, and in fact is what we might actually end up with in a number of areas of life. It is not as 'clever dick nonsense' as you think. It might be an undesirable idea, but it is a technically possible one. Your #3: Yes blockchains store and publicise. They also implement strong distributed consensus, and on top of those other things are layered, such as Ethereum-style smart contracts, and zero-knowledge calculations. If you think those cannot be used to control the release of fragmented or encrypted secrets driven by measurements of human decisions, you haven't understood them yet. I really recommend you look at ZKProof.org, and have a think about how privacy-maintaining blockchain coins like Zcash and Monero are able to use a public blockchain to exchange secret transactions. Note: I have no stake in this, I'm not a cryptocurrency or blockchain fan particularly. But I do understand how they work, and I'm not fooled by the buzzwords (at all, I'm quite skeptical).
teddyh 6y ago
> they might vote that your nefarious chat should be opened up You are implicitly assuming that this is the only way that the chats can be decrypted. This is only true until the keys are compromised. And the keys will be compromised, because: 1. The keys are worth a lot to the right people. 2. The parties which have the keys have no real incentive to secure the keys well. 3. There is no way for an party with a key to become aware that the key has been compromised. 1, 2, and 3 will combine into a state of the world in which the keys are always compromised.
- jlokier 6y ago
  I think 2 and 3 are incorrect under my scheme. If parties host key fragments themselves, unencrypted, then I'd agree with both 2 and 3. However if the keys are encrypted in such a way that parties can only decrypt them by posting confirmation to a blockchain (or equivalent), two things occur: 2a. The parties have a very strong incentive to secure their transaction-posting-keys, because those are the same keys as they use to protect their own other valuable assets such as cryptocurrency, or whatever else they are securing these days such as DAO governance. Some people will be sloppy (and lose their own money and other things), but on a large scale, perhaps it's an open question so far how many people will be that sloppy. If it's not too many people, the system is not compromised. 3a. Any party will become aware their own transaction-posting-key is used as soon as they see a transaction under their identity posted to the blockchain they participate in. They can also see how it's used. I've said blockchain but it doesn't actually need a blockchain. If there is one, it can be private or public. Either way, 2a and 3a apply. The main thing is there is an agreed "consensus location" into which people can choose whether to pool enough information to reconstitute the originally protected conversation key, with their only unencrypted secret being their multi-use key they are strongly incentivised to guard (2a), and to which they will only post if they can detect when it's used and limit how it's used (3a).
  - teddyh 6y ago
    Those do sound like reasonable design decisions, but in practice the systems which are eventually actually implemented are basically never as well-designed as that.
c1ccccc1 6y ago
Some interesting thoughts here, but the issue of the key leaking is still a problem with your proposed protocol. After the first time all these trusted parties come together and reveal the key, someone still has to actually take the key and decrypt the relevant message. After that point, the key exists in plaintext, and it will be very difficult to ensure that it remains secret. Same problem with giving the key only to an AI: The AI needs the key, and it will be difficult to ensure that the AI system isn't hacked, especially if it's the kind of large distributed system that would be required to process everyone's messages. What you're looking for is a protocol where N parties have to agree in order to decrypt any given message, and agreement to decrypt a particular message doesn't allow them to decrypt any other messages. Here's one that might accomplish that (disclaimer: I am not a cryptographer): - People can use whatever end to end encryption scheme they like to send their messages, but they must Shamir-split the key into N parts, and send those parts to the relevant authorities. - We can check that people are obeying this protocol without violating their privacy by the following method: Every time someone sends a message, they xor it with a string of random bits. Then they send it in 2 parts: the xored message, and the original string of random bits. The original message can only be reconstructed from both parts. Each part is sent with a separate key. The N authorities randomly choose one of the two parts to open. They then check that it decrypts properly (messages will include a hash of the contents, so that this is easily checkable, and difficult to fake). - Of course, people may not trust the authorities to only decrypt one of their message pair. The solution to this is that the list of N authorities is always the same, except for the last one: this is a choice server. People can use whatever choice server they like. However, all choice servers are required to be auditable by both the government and the public. It's the choice server's job to (1) randomly choose 1 message from each pair to decrypt, (2) not release the Shamir-fragment for the key to the other message unless given a warrant by a judge. Of course, this will be inconvenient, imperfect, and add a heck of a lot of overhead. Some choice servers will be found to be corrupt either in favour of the intelligence agencies, or the criminals, having managed to hide their corruptness from audits. It also will not stop determined criminals from using their own encryption. It's not all that easy to tell when people are sending encrypted messages to each other, the messages will just look like random bits. There are plenty of places in perfectly innocuous seeming messages to hide random bits. They could even be hidden as noise added to a particular image. A random-bit-hiding arms race is one that cipher-users are inevitably going to win.

tzs 6y ago

Given the existence of end-to-end strong encrypted group chat systems, it is trivial to construct something between your #1 and #2. Simply use end-to-end strong encrypted group chat and require that when a user creates a new chat room that they invite a government agent into the room.