6 ms·

The UK has threatened this on and off for a while. I recall around 2000 they proposed a bill which would have forced everyone who wanted to use encryption to e

The UK has threatened this on and off for a while. I recall around 2000 they proposed a bill which would have forced everyone who wanted to use encryption to escrow a key with the government. I used to watch some TV in those days and the UK programme "NewsNight" had a discussion about it. There proposing the idea was some poor government flunky. There explaining the flaws in the idea was Whitfield Diffie[1]. Diffie just started by explaining that cybersecurity is all about securing some asset from threats such that the cost of attack was too great given the value of the asset. How do you protect the store that has all the cryptographic keys in the entire United Kingdom? It would be essentially infinitely valuable as a cyberattack target. Government dude was totally out of his depth and the bill was eventually dropped. [1] Turing award winner and the Diffie in Diffie-Hellman. Fair to say he's a guy who knows a thing or two about cryptography.

quickthrower2 4y ago
Ironic considering we have things now like gmail, and god knows how many services you could get access to via password resets if you could get access to all the emails. Or CI systems for another example
timthorn 4y ago
That was perhaps just the UK response to the Clipper Chip.
traceroute66 4y ago
> UK programme "NewsNight" had a discussion about it. There proposing the idea was some poor government flunky. There explaining the flaws in the idea was Whitfield Diffie Aah, the good old days when the BBC was un-biased. These days you would get a government flunky, and on the other side of the table a pro-government flunky from a lobbying outfit whose real accreditation has been carefully omitted by the BBC and they have been instead been given some generic independent sounding job title. I'm not joking! BBC Radio 4 famously recently did a "Brexit anniversary programme". Three people in the studio, the presenter and two guests. The two guests were .... Theresa Villiers and Daniel Hannan, two hardcore Brexteers who, of course, spent the entire interview session fighting completely unchallenged over who could give the most sycophantic sunlit-uplands view of Brexit.
- ben_w 4y ago
  The BBC certainly has a lot of problems with regard to actual independence, but I would like to *ahem* provide some balance by pointing to the satirical popular news quiz "Have I Got News For You" which spent the early part of the Blair years having to beep out certain references to Peter Mandelson — the Dominic Cummings of his era — that only ended with (from memory): ???: "Peter Mandelson is a hom… owner" Regular guest: "Why can't gay people own homes?" Host: "Well, new Director General, let's see if that goes out." At the time, and I'm pleasantly amazed how fast this has changed, being gay and in charge was still mildly scandalous in the eyes of tabloids, and that was about the same time the age of consent was equalised. However such (entirely valid) reasons for respecting privacy should be for all, but as far as I remember Mandelson was the only person who got to keep that particular secret. Conversely, right after the referendum someone said the BBC should play "God Save The Queen" at the end of the day's programming in concordance with the departure from the EU, and Newsnight responded with this, which is still up on their official channel: https://youtu.be/WwsQ_5Wm4oo https://youtu.be/WwsQ_5Wm4oo
  - traceroute66 4y ago
    > Blair years having to beep out certain references to Peter Mandelson — the Dominic Cummings of his era I thought Alastair Campbell was Blair's Cummings ?
    - WediBlino 4y ago
      Cambell was Blair's Tucker.
    - giobox 4y ago
      Campbell is IMO the more appropriate comparison too - Mandelson was an elected MP and later a Lord during Blair/Brown years, he wasn't a SPAD for hire like Cummings or Campbell. That said, the three of them worked very closely together - Blair, Mandelson and Campbell.
    - ben_w 4y ago
      I'm thinking mainly of the perception of each was that they were a dislikable Machiavellian power behind the throne: https://youtu.be/IWKBe7L50VA https://youtu.be/IWKBe7L50VA
darrenf 4y ago
> the bill was eventually dropped If you're referring to the Electronic Communications Bill, it did indeed become an act. And in fact it contained an explicit section prohibiting the imposition of escrow (which has not been removed by any subsequent amendments): https://www.legislation.gov.uk/ukpga/2000/7/part/III https://www.legislation.gov.uk/ukpga/2000/7/part/III 14 Prohibition on key escrow requirements (1) Subject to subsection (2), nothing in this Act shall confer any power on any Minister of the Crown, on the Scottish Ministers, on the National Assembly for Wales or on any person appointed under section 3— (a) by conditions of an approval under Part I, or (b) by any regulations or order under this Act, to impose a requirement on any person to deposit a key for electronic data with another person. What's more, you can read a transcript of a parliamentary debate about escrow where all sides were keen to ensure it was clearly not part of the final text https://www.theyworkforyou.com/debates/?id=2000-01-25a.174.1 https://www.theyworkforyou.com/debates/?id=2000-01-25a.174.1 The debate on key escrow raged for some time. Foremost among the original proponents of key escrow was my hon. Friend the Member for Esher and Walton (Mr. Taylor). However, the debate has moved on—as has my hon. Friend, who has changed his mind because we have learned much more about the matter. All credit is due to him for that. It was thus crucial that key escrow should not be included in the Bill. There would be no power for the Government, or for some agency, to demand that the key—as between public and private—for the de-encryption of material could be deposited with a third party. However, we were concerned that key escrow might be introduced through the back door.
- InCityDreams 4y ago
  >Friend, who has changed his mind because we have learned much more about the matter. All credit is due to him for that. Complimented for being a rational human being, no less.
  - AlecSchueler 4y ago
    Always good to reinforce positive behaviour especially amongst legislators.
  - pjc50 4y ago
    https://en.wikipedia.org/wiki/Ian_Taylor_(British_politician) https://en.wikipedia.org/wiki/Ian_Taylor_(British_politician... : appears to be the now almost vanished old school type of conservative. Member of the Worshipful Company of Information Technologists, so at least knows some tech people. Europhile, to the extent of quitting the party over Brexit. Pro-space exploration. Anti-Iraq-war. No wonder he quit.
JTbane 4y ago
>How do you protect the store that has all the cryptographic keys in the entire United Kingdom? Also I don't trust any government not to mishandle crypto keys, so backdoored encryption = broken encryption
chacham15 4y ago
> It would be essentially infinitely valuable as a cyberattack target. While I understand what you mean, there are already keys which are "infinitely valuable": root CA keys. If you have those, you can essentially impersonate anyone. Therefore, we must have ways to protect these sort of keys. That being said, a root CA key is probably locked up on an air gapped machine vs some machine which actively using the key to scan through traffic. Mainly pointing out here that the idea of value vs cost has to have some point at which we protect it regardless of the value because thats how the hierarchy of trust works in our CA system.
- andromeduck 4y ago
  but there are multiple roots
  - swexbe 4y ago
    There are also multiple countries
    - andromeduck 4y ago
      Escrow compromise as described has a iserial systems failure probability wheres today with root keyts it's parallel. That's weakest link vs isolated/partitioned. CAs have been nuked on occasion without much fanfare to everyday users.
      - swexbe 4y ago
        You could theoretically set up multiple competing government agencies, each with their own root key. That would deal even with organisational risk.
- lb1lf 4y ago
  They've got a ceremony for that! https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/ https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/
- 4y ago
varispeed 4y ago
It's a sign of slowly moving Overton Window. They'll eventually get it.
usrbinbash 4y ago
> Diffie just started by explaining ... https://www.newscientist.com/article/2140747-laws-of-mathematics-dont-apply-here-says-australian-pm/ https://www.newscientist.com/article/2140747-laws-of-mathema...
timcavel 4y ago
[dead]

quickthrower2 4y ago

Ironic considering we have things now like gmail, and god knows how many services you could get access to via password resets if you could get access to all the emails. Or CI systems for another example

timthorn 4y ago

That was perhaps just the UK response to the Clipper Chip.

traceroute66 4y ago

> UK programme "NewsNight" had a discussion about it. There proposing the idea was some poor government flunky. There explaining the flaws in the idea was Whitfield Diffie Aah, the good old days when the BBC was un-biased. These days you would get a government flunky, and on the other side of the table a pro-government flunky from a lobbying outfit whose real accreditation has been carefully omitted by the BBC and they have been instead been given some generic independent sounding job title. I'm not joking! BBC Radio 4 famously recently did a "Brexit anniversary programme". Three people in the studio, the presenter and two guests. The two guests were .... Theresa Villiers and Daniel Hannan, two hardcore Brexteers who, of course, spent the entire interview session fighting completely unchallenged over who could give the most sycophantic sunlit-uplands view of Brexit.

ben_w 4y ago
The BBC certainly has a lot of problems with regard to actual independence, but I would like to *ahem* provide some balance by pointing to the satirical popular news quiz "Have I Got News For You" which spent the early part of the Blair years having to beep out certain references to Peter Mandelson — the Dominic Cummings of his era — that only ended with (from memory): ???: "Peter Mandelson is a hom… owner" Regular guest: "Why can't gay people own homes?" Host: "Well, new Director General, let's see if that goes out." At the time, and I'm pleasantly amazed how fast this has changed, being gay and in charge was still mildly scandalous in the eyes of tabloids, and that was about the same time the age of consent was equalised. However such (entirely valid) reasons for respecting privacy should be for all, but as far as I remember Mandelson was the only person who got to keep that particular secret. Conversely, right after the referendum someone said the BBC should play "God Save The Queen" at the end of the day's programming in concordance with the departure from the EU, and Newsnight responded with this, which is still up on their official channel: https://youtu.be/WwsQ_5Wm4oo https://youtu.be/WwsQ_5Wm4oo
- traceroute66 4y ago
  > Blair years having to beep out certain references to Peter Mandelson — the Dominic Cummings of his era I thought Alastair Campbell was Blair's Cummings ?
  - WediBlino 4y ago
    Cambell was Blair's Tucker.
  - giobox 4y ago
    Campbell is IMO the more appropriate comparison too - Mandelson was an elected MP and later a Lord during Blair/Brown years, he wasn't a SPAD for hire like Cummings or Campbell. That said, the three of them worked very closely together - Blair, Mandelson and Campbell.
  - ben_w 4y ago
    I'm thinking mainly of the perception of each was that they were a dislikable Machiavellian power behind the throne: https://youtu.be/IWKBe7L50VA https://youtu.be/IWKBe7L50VA

darrenf 4y ago

> the bill was eventually dropped If you're referring to the Electronic Communications Bill, it did indeed become an act. And in fact it contained an explicit section prohibiting the imposition of escrow (which has not been removed by any subsequent amendments): https://www.legislation.gov.uk/ukpga/2000/7/part/III https://www.legislation.gov.uk/ukpga/2000/7/part/III 14 Prohibition on key escrow requirements (1) Subject to subsection (2), nothing in this Act shall confer any power on any Minister of the Crown, on the Scottish Ministers, on the National Assembly for Wales or on any person appointed under section 3— (a) by conditions of an approval under Part I, or (b) by any regulations or order under this Act, to impose a requirement on any person to deposit a key for electronic data with another person. What's more, you can read a transcript of a parliamentary debate about escrow where all sides were keen to ensure it was clearly not part of the final text https://www.theyworkforyou.com/debates/?id=2000-01-25a.174.1 https://www.theyworkforyou.com/debates/?id=2000-01-25a.174.1 The debate on key escrow raged for some time. Foremost among the original proponents of key escrow was my hon. Friend the Member for Esher and Walton (Mr. Taylor). However, the debate has moved on—as has my hon. Friend, who has changed his mind because we have learned much more about the matter. All credit is due to him for that. It was thus crucial that key escrow should not be included in the Bill. There would be no power for the Government, or for some agency, to demand that the key—as between public and private—for the de-encryption of material could be deposited with a third party. However, we were concerned that key escrow might be introduced through the back door.

InCityDreams 4y ago
>Friend, who has changed his mind because we have learned much more about the matter. All credit is due to him for that. Complimented for being a rational human being, no less.
- AlecSchueler 4y ago
  Always good to reinforce positive behaviour especially amongst legislators.
- pjc50 4y ago
  https://en.wikipedia.org/wiki/Ian_Taylor_(British_politician) https://en.wikipedia.org/wiki/Ian_Taylor_(British_politician... : appears to be the now almost vanished old school type of conservative. Member of the Worshipful Company of Information Technologists, so at least knows some tech people. Europhile, to the extent of quitting the party over Brexit. Pro-space exploration. Anti-Iraq-war. No wonder he quit.

JTbane 4y ago

>How do you protect the store that has all the cryptographic keys in the entire United Kingdom? Also I don't trust any government not to mishandle crypto keys, so backdoored encryption = broken encryption

chacham15 4y ago

> It would be essentially infinitely valuable as a cyberattack target. While I understand what you mean, there are already keys which are "infinitely valuable": root CA keys. If you have those, you can essentially impersonate anyone. Therefore, we must have ways to protect these sort of keys. That being said, a root CA key is probably locked up on an air gapped machine vs some machine which actively using the key to scan through traffic. Mainly pointing out here that the idea of value vs cost has to have some point at which we protect it regardless of the value because thats how the hierarchy of trust works in our CA system.

andromeduck 4y ago
but there are multiple roots
- swexbe 4y ago
  There are also multiple countries
  - andromeduck 4y ago
    Escrow compromise as described has a iserial systems failure probability wheres today with root keyts it's parallel. That's weakest link vs isolated/partitioned. CAs have been nuked on occasion without much fanfare to everyday users.
    - swexbe 4y ago
      You could theoretically set up multiple competing government agencies, each with their own root key. That would deal even with organisational risk.
lb1lf 4y ago
They've got a ceremony for that! https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/ https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/
4y ago

varispeed 4y ago

It's a sign of slowly moving Overton Window. They'll eventually get it.

usrbinbash 4y ago

> Diffie just started by explaining ... https://www.newscientist.com/article/2140747-laws-of-mathematics-dont-apply-here-says-australian-pm/ https://www.newscientist.com/article/2140747-laws-of-mathema...

timcavel 4y ago

[dead]