16 ms·

Plausibly deniable encryption (2020)

229 points by rzk 5y ago

anonymousiam 5y ago
Not mentioned in the article are the consequences of using a SSD with trim. Trim would destroy the data in the hidden encrypted volume.
- boring_twenties 5y ago
  Trim is not really recommended for any encrypted volume to begin with, since it clearly reveals how much space is being used as well as some other filesystem metadata.
- a20eac1d 5y ago
  Does this apply to full disk encryption with Windows and VeraCrypt? If so, do I need to disable TRIM? If yes, in Windows or the BIOS?
  - anonymousiam 5y ago
    It does not apply to most mainstream encryption methods. Most methods will allocate the sectors containing encrypted data, but you need to use the decryption APIs to access the data.
- drsnow 5y ago
  Are you saying you should never use TRIM on an SSD that is encrypted?
  - anonymousiam 5y ago
    I am saying that if you use a disk encryption technology that puts the encrypted data in unallocated sectors (which is a plausibly deniable method), if you run (or your OS automatically runs) trim on the media, all of the data in the unallocated space will be lost.
  - Teknoman117 5y ago
    Using TRIM means you can't plausibly deny using encryption on the disk. Any data trimmed will read as zeros. It also opens you up to a few more attack vectors since the attacker knows exactly where the ciphertext is located (start, end, size, etc.). This means that if your filesystem has data structures in fixed locations, they know exactly where in the ciphertext those would be located and can focus attacks on those since there is a significantly smaller set of possibilities for what the plaintext could be. In practice, it depends on the level of paranoia that's needed for your situation. Trying to prevent your average thief from getting your bank info off your laptop? Probably not an issue. Hiding data from the NSA? Possibly a problem. I run TRIM on my SSDs, but I also live in a country where theoretically I don't have to give up the key. Admittedly, I'm not doing anything illegal, the only thing they'll find are a bunch of git repos, game installs, 2000's alternative rock, Scandinavian folk metal, and bad vacation pictures.
mLuby 5y ago
She could claim that the key for those books has been lost or forgotten. I wonder if this "I forgot" defense is more accepted now that there are stories of people having forgotten the password to their multi-million dollar cryptocurrency wallets.
- cle 5y ago
  "Forgot" is a bit strong, how about "I don't recall". (reference: https://www.youtube.com/watch?v=7IBvZlRqOTw https://www.youtube.com/watch?v=7IBvZlRqOTw)
  - hinkley 5y ago
    Ronald Reagan used this during the Iran Contra investigation as well. Boy, did the universe pull a monkey's paw on him for that.
    - munk-a 5y ago
      And after the extreme political fallout of the Iran Contra nobody involved ever stood a chance in politics ever again. I don't know if you recall what happened to Oliver North but it was brutal - he had to endure cushy political appointments for the rest of his life.
    - jkestner 5y ago
      I understand insanity is a plausible defense, too, John.
m3kw9 5y ago
What if they detect the protocol?
- cortesoft 5y ago
  Good encryption protocols create cyphertext that is indistinguishable from random data. You can't tell the protocol from the cyphertext.
  - charcircuit 5y ago
    Can you give an example of one of these "good" protocols? Most are not just random data.
    - betwixthewires 5y ago
      So we are getting into information theory, but any cryptographic protocol that generates cyphertext that is distinguishable from random noise is easier to crack than the stated security level. So a 128 bit encryption protocol, if the cyphertext can be found to have any data in it that can be demonstrated to be non random, the protocol does not have 128 bits of security. All good encryption protocols will always create cyphertext that is indistinguishable from random noise, this is not an endorsement of any "good" protocols, but rather a general statement about encryption which must be true. You should not be able to infer anything about the data encoded in the cyphertext without the key.
      - charcircuit 5y ago
        My comment was based off a misunderstanding of what was meant by protocol.
    - notfed 5y ago
      I'll drop two of my "good" creations here. The first [1] is for encryption at rest, and the second [2] is for encryption in transit. (Of course, saltunnel [2] leaks bandwidth and timing information: a transport protocol which does not will surely have sufferable performance.) [1] https://puree.cc https://puree.cc [2] https://saltunnel.io https://saltunnel.io
noel99 5y ago
I was one of the activists who had their computers seized. I told the police to kiss my ass and they gave up trying to get my password. Though I guess a 6 month concurrent sentence when you’ve already got 4 years isn’t worth the paperwork. Prison was butlins btw. I highly recommend it. Plenty of time to read books
- meetups323 5y ago
  What does animal rights activism to the point of that level of government interest look like? Linked article didn't go into any details on the matter at hand.
  - noel99 5y ago
    “Urban terrorism” according to the incredibly foolish judge. Considering no one ever had a finger laid on them he would have a shock if he ever found out about the IRA
    - bmsleight_ 5y ago
      Not sure I feel comfortable with celebrating breaking the law. No one laid a finger - ok no physical violence. However some off the tactics used against people involved in activities you disagree with were not pleasant. I not sure I agree with the narrative that it is a victimless crime. On the other hand prison works rehabilitated in to society.
      - noel99 5y ago
        Prison doesn’t work. At all. My views are more radical than ever. The lesson to learn is; never try to effect serious social change via peaceful means, go directly to illegal means, bypassing legal protest will mean the police won’t know who they are looking for. I can’t say I lose a seconds sleep over the “victims”, they are weak minded crybabies
        missedthecue 5y ago
chrchang523 5y ago
Closely related topic: https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography
cookiengineer 5y ago
There's always LUKS to cover this scenario: Nuke Keys that get activated with a second password. [1] [1] https://github.com/roema/cryptsetup-nuke https://github.com/roema/cryptsetup-nuke
- boring_twenties 5y ago
  The adversary can easily just copy the encrypted data before trying to decrypt it.
  - brian_herman 5y ago
    I think the idea is to have them enter the password that destroys the data.
    - ratg13 5y ago
      That may have worked 10-20 years ago. These days there are established procedures and protocols that prevent this.
      - ohyeshedid 5y ago
        What protocols stop a person from removing the drive from your machine, and imaging the drive?
        g_p 5y ago
        Not even just that - in addition to imaging, write blockers should be used for evidential integrity as well.
        singlow 5y ago
        I think that's the point of that comment. Police have procedures now to prevent a nuke script from being effective.
        amiga-workbench 5y ago
drexlspivey 5y ago
BIP-39 mnemonics are designed like this, you can add an optional passphrase to the 12/24 mnemonic words and it unlocks a different set of privatekeys. This way you can have a passphrase (or no passphrase) where you only store a small amount of cryptocurrency and a separate passphrase that unlocks your real wallet, to avoid the $5 wrench attack.
- throwhauser 5y ago
  If you're being attacked with a wrench, wouldn't you want to avoid deniable encryption? If there's no way to 100% establish that all the money has been extracted, an attacker might keep going indefinitely to see if there's more.
  - littlestymaar 5y ago
    In fact, since there's no way you can prove that you haven't used deniable encryption, you'll probably be in a really bad place anyway. That creates an interesting game theory situation though, where nobody has any incentive to disclose anything, since it wouldn't change the outcome anyway, which ends up negating the whole point of torture: the victim needs to believe that the tormentor will stop if they disclose the truth. (Unfortunately, the real world isn't a game theory problem…).
    - deleted 5y ago
      [deleted]
    - dane-pgp 5y ago
      This is the game theory that the Rubberhose file system (co-invented by one Julian Assange) is based on.[0] It's a pity the blog post didn't link to that article, and only linked to the one about rubber-hose cryptanalysis, since this prior art does seem to overlap significantly with the scheme that the post is proposing, as does the Owner-Free Filesystem[1]. Anyway, you're right that the real world isn't a game theory problem, but I do think that if someone is faced with being tortured for information, they should at least attempt to ask the torturer "How do I know that you will stop when I give you the information?". Or, perhaps less incriminatingly, "I don't have that information, and it doesn't matter because you'll keep torturing me regardless". You may not be able to convince the torturer to give up on the torture (much less convince them to let you go free), but you might at least be able to convince yourself that there is no point talking or trying to come up with a lie. Having said that, it's also instructive to look at the example of Marcus McDilda who was tortured by the Japanese for information about atomic bombs, about which he knew nothing.[2] His lies may have saved not just his own life, but millions more. [0] https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 [1] https://en.wikipedia.org/wiki/OFFSystem https://en.wikipedia.org/wiki/OFFSystem [2] https://en.wikipedia.org/wiki/Marcus_McDilda https://en.wikipedia.org/wiki/Marcus_McDilda
bruce343434 5y ago
ugh, why the single letter variables? Makes the text that much harder to read imo. I keep having to think to myself "oh yeah, that means 'the key'"
- bowmessage 5y ago
  but it makes the author look smart /s[arcasm]
- Koshkin 5y ago
  In mathematical writing variable names are usually single-letter. (This, in fact, makes mathematics easier to read and, especially, compute with.)
  - Gigachad 5y ago
    I think sometimes this makes sense. In a lot of math, there isn’t actually a reasonable name for the variable. It’s intermediary and has no real meaning other than it’s full definition. But I think sometimes they do take it too far and use single letters when full names could exist.
    - bruce343434 5y ago
      In this case the author literally gives the full names sometimes. And in fact he leads a paragraph with "Asserting the non-existence (2) of the ciphertext" so whether something gets a one letter variable and some formal logic operator or whether it gets expressed in plain English seems totally arbitrary.
- ouid 5y ago
  There's a lot of symmetry in the formula, and if you start throwing a bunch of english into the mix, it becomes harder to see. That symmetry is often important for synthesizine a new argument, whereas the naming conventions are important for reminding you what the objects in question are. This factors the reader's job and the writer's job fairly cleanly. The reader is responsible for mapping their intuition onto the objects being referenced, and the writer is responsible for demonstrating their relationship.
lisper 5y ago
Somewhat related: https://catless.ncl.ac.uk/Risks/16/87#subj3 https://catless.ncl.ac.uk/Risks/16/87#subj3 (This is an article I wrote for Risks digest in 1995 regarding a proposed law that would have made it illegal to transmit pornography over the internet.)
- nonrandomstring 5y ago
  > It's probably old news for RISKS readers, but a very difficult concept for > lawmakers, that the semantic content of bit streams is in the eye of the > beholder, and that the apparent correspondence between bits and semantics is > the result of engineering convention and not an inherent property of the > bits. Nice article with great points. I gave a talk about this in 2005 on why the more data intelligence agencies collect the worse their results if their analysis does not match their reach. It goes back to Quine and Shannon's ideas of salience as pre-agreed patterns of interpretation. The talk was actually about a spooky phenomenon called "listening in readiness". Mediums/charlatans and other cold-reading hucksters used EVP (electronic voice phenomena) in the 1930's and 40s, when radio, Theramins and such-like were more woo-woo and barely understood by ordinary people. If you play what is essentially noise/static to people and _tell_ (or suggest) to them that voices are saying something - they will hear that. The phenomenon is surprisingly reproducible. It works because the cochlea and auditory neural system (See a text like Nelken, King and Schupp's Auditory Neuroscience) can "listen in readiness". We have affective and sensory hairs and feedback loops in the cochlea that allow us to "tune" to what we _expect_ to hear. In simple words, people can hear what they expect/want to hear. When we apply AI and adaptive filters to data, a similar thing is happening. False positives, indeed very elaborate misinformation can be derived in intelligence work based on unsupervised (arbitrary mass surveillance) when the gatherer starts with an a-priori idea of what they are looking for and sifts through chatter. I am not sure exactly how yet, but I think this can be leveraged to some good use in privacy protection if, as in the Dissident scheme discussed in TFA, there is some "fuzzy" decryption and very many plausible but false decodings adjacent to cipher-text. This leads to the idea of a cupher that is apparently very easy to crack, but yields a false plaintext. When you "can't remember" the password, your adversary finds a low hanging "trap password" and smugly thinks they defeated your poor opsec.
deleted 5y ago
[deleted]
algrio 5y ago
Another technique if you are interested, two factor encryption: https://www.alvarez.io/posts/two-factor-encryption/ https://www.alvarez.io/posts/two-factor-encryption/
openfuture 5y ago
If you want plausible deniability just have a few obscure ctfs cloned next to your fake ctfs that you haven't solved yet.
garaetjjte 5y ago
To avoid questions of suspicious unallocated space with hidden volume, what about this: Use disk with vastly higher capacity than you really need. Use standard filesystem on it. For hidden volume, store data redundantly in multiple locations inside unallocated space of standard filesystem. When running from hidden volume you can avoid overwriting data on standard filesystem. When running from standard volume you cannot, and it could overwrite some parts of hidden data, but it will be repaired from copies stored in many other locations. Standard volume should be also encrypted to provide deniability why unallocated space contains random-looking data.
- dheera 5y ago
  Now I just wish there were actually competent encryption that can keep up with PCIe SSD speeds. I have no option but to just use the BIOS SSD password encryption thingy instead of some Ubuntu LUKS or ecryptFS which are both slow AF.
  - sockpuppet69 5y ago
  - Avamander 5y ago
    What are "PCIe SSD speeds"? A good CPU can do thousands of megabytes per second using a LUKS with a strong cipher (ecryptfs is a very different thing, not speaking of that). What numbers did you get from "cryptsetup benchmark"? Saying you want "actually competent encryption" and then resorting to using "BIOS SSD password encryption thingy" is kinda funny.
btilly 5y ago
I'm amazed that they didn't discuss https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography as an approach. There are lots of ways to hide encrypted data such that it is not obvious that there is any data at all to be found.
Tade0 5y ago
What ever happened to good old steganography? Or communicating via trading NFTs with the message encoded in slight differences between the images? I'm sure there's at least 5 bits of data in the details of a single Bored Ape picture.
- delecti 5y ago
  Given there are 10,000 Bored Apes, there's at least a whopping 13 bits of data.
tifadg1 5y ago
Are the any configurations of LUKS that could achieve this?
- seqizz 5y ago
  https://blog.linuxbrujo.net/posts/plausible-deniability-with-luks/ https://blog.linuxbrujo.net/posts/plausible-deniability-with...
- notfed 5y ago
  Not without unfortunate tradeoffs. This motivated me to create PUREE (https://puree.cc https://puree.cc). PUREE satisfies the "random-looking" goal, and in my (biased) opinion is easier to use than LUKS. "Plausibile deniability" is a fuzzy, more complicated subject of which PUREE provides no claims.
upofadown 5y ago
A coworker who grew up in Pakistan was telling stories one day. He said the place that he grew up in had the best police in the whole world. There were no unsolved crimes. The police always got a confession. XKCD-538 has an implied third panel: Right guy: Wait, we can use the $5 wrench? Why not just hit him until he confesses and names all his friends as co-conspirators as per normal? Left guy: Yes, let's skip the geeky stuff entirely. We will be done before lunch. People that use torture are not interested in any sort of objective truth. Otherwise they would not do that.
- noel99 5y ago
  - bduerst 5y ago
    Such as?
- dane-pgp 5y ago
  And here's the fourth panel: Right guy: Actually, why did we waste that $5 on a wrench when we can just forge a confession document? Left guy: Yeah, and we can say that he also told us the names of his co-conspirators, who happen to be the people I owe money to, the annoying guy who lives next door to me, my ex-wife, and anyone I can think of from the minority group that I want to feel superior to.
HoraceSchemer 5y ago
moonchild 5y ago
> Claim C is new and has some appealing properties but it can’t be used on a personal storage medium Freenet?
nirui 5y ago
> If, under duress, Alice is forced to reveal a decoy key that pieces together data from `m` books, she needs some way to explain the remaining `n−m` books that were not used. If I read it correctly, then the adversary might extract the data decrypted via the decoy key, and then reconstruct the encrypted payload using the extracted data and the decoy key. By comparing reconstructed encryption payload with the actual sample, it is easy for the adversary to figure out a better `m` to determine whether Alice is hiding something or not. I assume the approach that the article is showing only works if the encrypted meaningful data is stored in a fix sized container (say a disk volume or a fix sized file) that is initialized with random data, so knowing the size of `n-m` doesn't matter. > She could claim that, It just don't work like this if the adversary knows that you have installed some encryption software on your system that allows you to decrypt different content with different passwords. Just hide your real crypto wallet on one of your 10 years old HDD that still got Windows 7, Microsoft Office and Doom installed. Encrypt the wallet, then put it inside C:\Windows\System32 or similar and give it a system-like name such as `sysdump`. After you've done that, make a fake crypto wallet and put it on a expensive USB drive, lock the drive in a safe, then hide the safe in a hole of your basement.
denton-scratch 5y ago
The article seems to be based on the assumption that plausible deniablility requires hidden volumes or unused "random" data. Surely the use of one-time pads gets around that? A OTP cyphertext can be decrypted to any desired plaintext by providing the appropriate key. It's trivial to generate a key from an OTP cyphertext that will turn that cyphertext into a collection of kitten photos, for example. So Alice produces the kitten key under duress, and Mallory can't show that she also has a missile-secrets key that she hasn't disclosed. There's no unexplained "random" data, and no unused space on the storage medium. Voila - Alice is off the hook (unless Mallory is the kind of person that enjoys pulling fingernails, and carries on with the $5-wrench thing anyway).

229 points by rzk 5y ago

Not mentioned in the article are the consequences of using a SSD with trim. Trim would destroy the data in the hidden encrypted volume.

boring_twenties 5y ago
Trim is not really recommended for any encrypted volume to begin with, since it clearly reveals how much space is being used as well as some other filesystem metadata.
a20eac1d 5y ago
Does this apply to full disk encryption with Windows and VeraCrypt? If so, do I need to disable TRIM? If yes, in Windows or the BIOS?
- anonymousiam 5y ago
  It does not apply to most mainstream encryption methods. Most methods will allocate the sectors containing encrypted data, but you need to use the decryption APIs to access the data.
drsnow 5y ago
Are you saying you should never use TRIM on an SSD that is encrypted?
- anonymousiam 5y ago
  I am saying that if you use a disk encryption technology that puts the encrypted data in unallocated sectors (which is a plausibly deniable method), if you run (or your OS automatically runs) trim on the media, all of the data in the unallocated space will be lost.
- Teknoman117 5y ago
  Using TRIM means you can't plausibly deny using encryption on the disk. Any data trimmed will read as zeros. It also opens you up to a few more attack vectors since the attacker knows exactly where the ciphertext is located (start, end, size, etc.). This means that if your filesystem has data structures in fixed locations, they know exactly where in the ciphertext those would be located and can focus attacks on those since there is a significantly smaller set of possibilities for what the plaintext could be. In practice, it depends on the level of paranoia that's needed for your situation. Trying to prevent your average thief from getting your bank info off your laptop? Probably not an issue. Hiding data from the NSA? Possibly a problem. I run TRIM on my SSDs, but I also live in a country where theoretically I don't have to give up the key. Admittedly, I'm not doing anything illegal, the only thing they'll find are a bunch of git repos, game installs, 2000's alternative rock, Scandinavian folk metal, and bad vacation pictures.

mLuby 5y ago

She could claim that the key for those books has been lost or forgotten. I wonder if this "I forgot" defense is more accepted now that there are stories of people having forgotten the password to their multi-million dollar cryptocurrency wallets.

cle 5y ago
"Forgot" is a bit strong, how about "I don't recall". (reference: https://www.youtube.com/watch?v=7IBvZlRqOTw https://www.youtube.com/watch?v=7IBvZlRqOTw)
- hinkley 5y ago
  Ronald Reagan used this during the Iran Contra investigation as well. Boy, did the universe pull a monkey's paw on him for that.
  - munk-a 5y ago
    And after the extreme political fallout of the Iran Contra nobody involved ever stood a chance in politics ever again. I don't know if you recall what happened to Oliver North but it was brutal - he had to endure cushy political appointments for the rest of his life.
  - jkestner 5y ago
    I understand insanity is a plausible defense, too, John.

m3kw9 5y ago

What if they detect the protocol?

cortesoft 5y ago
Good encryption protocols create cyphertext that is indistinguishable from random data. You can't tell the protocol from the cyphertext.
- charcircuit 5y ago
  Can you give an example of one of these "good" protocols? Most are not just random data.
  - betwixthewires 5y ago
    So we are getting into information theory, but any cryptographic protocol that generates cyphertext that is distinguishable from random noise is easier to crack than the stated security level. So a 128 bit encryption protocol, if the cyphertext can be found to have any data in it that can be demonstrated to be non random, the protocol does not have 128 bits of security. All good encryption protocols will always create cyphertext that is indistinguishable from random noise, this is not an endorsement of any "good" protocols, but rather a general statement about encryption which must be true. You should not be able to infer anything about the data encoded in the cyphertext without the key.
    - charcircuit 5y ago
      My comment was based off a misunderstanding of what was meant by protocol.
  - notfed 5y ago
    I'll drop two of my "good" creations here. The first [1] is for encryption at rest, and the second [2] is for encryption in transit. (Of course, saltunnel [2] leaks bandwidth and timing information: a transport protocol which does not will surely have sufferable performance.) [1] https://puree.cc https://puree.cc [2] https://saltunnel.io https://saltunnel.io

noel99 5y ago

I was one of the activists who had their computers seized. I told the police to kiss my ass and they gave up trying to get my password. Though I guess a 6 month concurrent sentence when you’ve already got 4 years isn’t worth the paperwork. Prison was butlins btw. I highly recommend it. Plenty of time to read books

meetups323 5y ago
What does animal rights activism to the point of that level of government interest look like? Linked article didn't go into any details on the matter at hand.
- noel99 5y ago
  “Urban terrorism” according to the incredibly foolish judge. Considering no one ever had a finger laid on them he would have a shock if he ever found out about the IRA
  - bmsleight_ 5y ago
    Not sure I feel comfortable with celebrating breaking the law. No one laid a finger - ok no physical violence. However some off the tactics used against people involved in activities you disagree with were not pleasant. I not sure I agree with the narrative that it is a victimless crime. On the other hand prison works rehabilitated in to society.
    - noel99 5y ago
      Prison doesn’t work. At all. My views are more radical than ever. The lesson to learn is; never try to effect serious social change via peaceful means, go directly to illegal means, bypassing legal protest will mean the police won’t know who they are looking for. I can’t say I lose a seconds sleep over the “victims”, they are weak minded crybabies
      - missedthecue 5y ago

chrchang523 5y ago

Closely related topic: https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography

cookiengineer 5y ago

There's always LUKS to cover this scenario: Nuke Keys that get activated with a second password. [1] [1] https://github.com/roema/cryptsetup-nuke https://github.com/roema/cryptsetup-nuke

boring_twenties 5y ago
The adversary can easily just copy the encrypted data before trying to decrypt it.
- brian_herman 5y ago
  I think the idea is to have them enter the password that destroys the data.
  - ratg13 5y ago
    That may have worked 10-20 years ago. These days there are established procedures and protocols that prevent this.
    - ohyeshedid 5y ago
      What protocols stop a person from removing the drive from your machine, and imaging the drive?
      - g_p 5y ago
        Not even just that - in addition to imaging, write blockers should be used for evidential integrity as well.
      - singlow 5y ago
        I think that's the point of that comment. Police have procedures now to prevent a nuke script from being effective.
      - amiga-workbench 5y ago

drexlspivey 5y ago

BIP-39 mnemonics are designed like this, you can add an optional passphrase to the 12/24 mnemonic words and it unlocks a different set of privatekeys. This way you can have a passphrase (or no passphrase) where you only store a small amount of cryptocurrency and a separate passphrase that unlocks your real wallet, to avoid the $5 wrench attack.

throwhauser 5y ago
If you're being attacked with a wrench, wouldn't you want to avoid deniable encryption? If there's no way to 100% establish that all the money has been extracted, an attacker might keep going indefinitely to see if there's more.
- littlestymaar 5y ago
  In fact, since there's no way you can prove that you haven't used deniable encryption, you'll probably be in a really bad place anyway. That creates an interesting game theory situation though, where nobody has any incentive to disclose anything, since it wouldn't change the outcome anyway, which ends up negating the whole point of torture: the victim needs to believe that the tormentor will stop if they disclose the truth. (Unfortunately, the real world isn't a game theory problem…).
  - deleted 5y ago
    [deleted]
  - dane-pgp 5y ago
    This is the game theory that the Rubberhose file system (co-invented by one Julian Assange) is based on.[0] It's a pity the blog post didn't link to that article, and only linked to the one about rubber-hose cryptanalysis, since this prior art does seem to overlap significantly with the scheme that the post is proposing, as does the Owner-Free Filesystem[1]. Anyway, you're right that the real world isn't a game theory problem, but I do think that if someone is faced with being tortured for information, they should at least attempt to ask the torturer "How do I know that you will stop when I give you the information?". Or, perhaps less incriminatingly, "I don't have that information, and it doesn't matter because you'll keep torturing me regardless". You may not be able to convince the torturer to give up on the torture (much less convince them to let you go free), but you might at least be able to convince yourself that there is no point talking or trying to come up with a lie. Having said that, it's also instructive to look at the example of Marcus McDilda who was tortured by the Japanese for information about atomic bombs, about which he knew nothing.[2] His lies may have saved not just his own life, but millions more. [0] https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 https://en.wikipedia.org/wiki/Rubberhose_%28file_system%29 [1] https://en.wikipedia.org/wiki/OFFSystem https://en.wikipedia.org/wiki/OFFSystem [2] https://en.wikipedia.org/wiki/Marcus_McDilda https://en.wikipedia.org/wiki/Marcus_McDilda

bruce343434 5y ago

ugh, why the single letter variables? Makes the text that much harder to read imo. I keep having to think to myself "oh yeah, that means 'the key'"

bowmessage 5y ago
but it makes the author look smart /s[arcasm]
Koshkin 5y ago
In mathematical writing variable names are usually single-letter. (This, in fact, makes mathematics easier to read and, especially, compute with.)
- Gigachad 5y ago
  I think sometimes this makes sense. In a lot of math, there isn’t actually a reasonable name for the variable. It’s intermediary and has no real meaning other than it’s full definition. But I think sometimes they do take it too far and use single letters when full names could exist.
  - bruce343434 5y ago
    In this case the author literally gives the full names sometimes. And in fact he leads a paragraph with "Asserting the non-existence (2) of the ciphertext" so whether something gets a one letter variable and some formal logic operator or whether it gets expressed in plain English seems totally arbitrary.
ouid 5y ago
There's a lot of symmetry in the formula, and if you start throwing a bunch of english into the mix, it becomes harder to see. That symmetry is often important for synthesizine a new argument, whereas the naming conventions are important for reminding you what the objects in question are. This factors the reader's job and the writer's job fairly cleanly. The reader is responsible for mapping their intuition onto the objects being referenced, and the writer is responsible for demonstrating their relationship.

lisper 5y ago

Somewhat related: https://catless.ncl.ac.uk/Risks/16/87#subj3 https://catless.ncl.ac.uk/Risks/16/87#subj3 (This is an article I wrote for Risks digest in 1995 regarding a proposed law that would have made it illegal to transmit pornography over the internet.)

nonrandomstring 5y ago
> It's probably old news for RISKS readers, but a very difficult concept for > lawmakers, that the semantic content of bit streams is in the eye of the > beholder, and that the apparent correspondence between bits and semantics is > the result of engineering convention and not an inherent property of the > bits. Nice article with great points. I gave a talk about this in 2005 on why the more data intelligence agencies collect the worse their results if their analysis does not match their reach. It goes back to Quine and Shannon's ideas of salience as pre-agreed patterns of interpretation. The talk was actually about a spooky phenomenon called "listening in readiness". Mediums/charlatans and other cold-reading hucksters used EVP (electronic voice phenomena) in the 1930's and 40s, when radio, Theramins and such-like were more woo-woo and barely understood by ordinary people. If you play what is essentially noise/static to people and _tell_ (or suggest) to them that voices are saying something - they will hear that. The phenomenon is surprisingly reproducible. It works because the cochlea and auditory neural system (See a text like Nelken, King and Schupp's Auditory Neuroscience) can "listen in readiness". We have affective and sensory hairs and feedback loops in the cochlea that allow us to "tune" to what we _expect_ to hear. In simple words, people can hear what they expect/want to hear. When we apply AI and adaptive filters to data, a similar thing is happening. False positives, indeed very elaborate misinformation can be derived in intelligence work based on unsupervised (arbitrary mass surveillance) when the gatherer starts with an a-priori idea of what they are looking for and sifts through chatter. I am not sure exactly how yet, but I think this can be leveraged to some good use in privacy protection if, as in the Dissident scheme discussed in TFA, there is some "fuzzy" decryption and very many plausible but false decodings adjacent to cipher-text. This leads to the idea of a cupher that is apparently very easy to crack, but yields a false plaintext. When you "can't remember" the password, your adversary finds a low hanging "trap password" and smugly thinks they defeated your poor opsec.

deleted 5y ago

[deleted]

algrio 5y ago

Another technique if you are interested, two factor encryption: https://www.alvarez.io/posts/two-factor-encryption/ https://www.alvarez.io/posts/two-factor-encryption/

openfuture 5y ago

If you want plausible deniability just have a few obscure ctfs cloned next to your fake ctfs that you haven't solved yet.

garaetjjte 5y ago

To avoid questions of suspicious unallocated space with hidden volume, what about this: Use disk with vastly higher capacity than you really need. Use standard filesystem on it. For hidden volume, store data redundantly in multiple locations inside unallocated space of standard filesystem. When running from hidden volume you can avoid overwriting data on standard filesystem. When running from standard volume you cannot, and it could overwrite some parts of hidden data, but it will be repaired from copies stored in many other locations. Standard volume should be also encrypted to provide deniability why unallocated space contains random-looking data.

dheera 5y ago
Now I just wish there were actually competent encryption that can keep up with PCIe SSD speeds. I have no option but to just use the BIOS SSD password encryption thingy instead of some Ubuntu LUKS or ecryptFS which are both slow AF.
- sockpuppet69 5y ago
- Avamander 5y ago
  What are "PCIe SSD speeds"? A good CPU can do thousands of megabytes per second using a LUKS with a strong cipher (ecryptfs is a very different thing, not speaking of that). What numbers did you get from "cryptsetup benchmark"? Saying you want "actually competent encryption" and then resorting to using "BIOS SSD password encryption thingy" is kinda funny.

btilly 5y ago

I'm amazed that they didn't discuss https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography as an approach. There are lots of ways to hide encrypted data such that it is not obvious that there is any data at all to be found.

Tade0 5y ago

What ever happened to good old steganography? Or communicating via trading NFTs with the message encoded in slight differences between the images? I'm sure there's at least 5 bits of data in the details of a single Bored Ape picture.

delecti 5y ago
Given there are 10,000 Bored Apes, there's at least a whopping 13 bits of data.

tifadg1 5y ago

Are the any configurations of LUKS that could achieve this?

seqizz 5y ago
https://blog.linuxbrujo.net/posts/plausible-deniability-with-luks/ https://blog.linuxbrujo.net/posts/plausible-deniability-with...
notfed 5y ago
Not without unfortunate tradeoffs. This motivated me to create PUREE (https://puree.cc https://puree.cc). PUREE satisfies the "random-looking" goal, and in my (biased) opinion is easier to use than LUKS. "Plausibile deniability" is a fuzzy, more complicated subject of which PUREE provides no claims.

upofadown 5y ago

A coworker who grew up in Pakistan was telling stories one day. He said the place that he grew up in had the best police in the whole world. There were no unsolved crimes. The police always got a confession. XKCD-538 has an implied third panel: Right guy: Wait, we can use the $5 wrench? Why not just hit him until he confesses and names all his friends as co-conspirators as per normal? Left guy: Yes, let's skip the geeky stuff entirely. We will be done before lunch. People that use torture are not interested in any sort of objective truth. Otherwise they would not do that.

noel99 5y ago
- bduerst 5y ago
  Such as?
dane-pgp 5y ago
And here's the fourth panel: Right guy: Actually, why did we waste that $5 on a wrench when we can just forge a confession document? Left guy: Yeah, and we can say that he also told us the names of his co-conspirators, who happen to be the people I owe money to, the annoying guy who lives next door to me, my ex-wife, and anyone I can think of from the minority group that I want to feel superior to.

HoraceSchemer 5y ago

moonchild 5y ago

> Claim C is new and has some appealing properties but it can’t be used on a personal storage medium Freenet?

nirui 5y ago

> If, under duress, Alice is forced to reveal a decoy key that pieces together data from `m` books, she needs some way to explain the remaining `n−m` books that were not used. If I read it correctly, then the adversary might extract the data decrypted via the decoy key, and then reconstruct the encrypted payload using the extracted data and the decoy key. By comparing reconstructed encryption payload with the actual sample, it is easy for the adversary to figure out a better `m` to determine whether Alice is hiding something or not. I assume the approach that the article is showing only works if the encrypted meaningful data is stored in a fix sized container (say a disk volume or a fix sized file) that is initialized with random data, so knowing the size of `n-m` doesn't matter. > She could claim that, It just don't work like this if the adversary knows that you have installed some encryption software on your system that allows you to decrypt different content with different passwords. Just hide your real crypto wallet on one of your 10 years old HDD that still got Windows 7, Microsoft Office and Doom installed. Encrypt the wallet, then put it inside C:\Windows\System32 or similar and give it a system-like name such as `sysdump`. After you've done that, make a fake crypto wallet and put it on a expensive USB drive, lock the drive in a safe, then hide the safe in a hole of your basement.

denton-scratch 5y ago

The article seems to be based on the assumption that plausible deniablility requires hidden volumes or unused "random" data. Surely the use of one-time pads gets around that? A OTP cyphertext can be decrypted to any desired plaintext by providing the appropriate key. It's trivial to generate a key from an OTP cyphertext that will turn that cyphertext into a collection of kitten photos, for example. So Alice produces the kitten key under duress, and Mallory can't show that she also has a missile-secrets key that she hasn't disclosed. There's no unexplained "random" data, and no unused space on the storage medium. Voila - Alice is off the hook (unless Mallory is the kind of person that enjoys pulling fingernails, and carries on with the $5-wrench thing anyway).