3 ms·

Could you [in theory] do some kind of zero knowledge proof or whatever that the plaintext belonging to a given ciphertext does [not] have a certain property? He

Could you [in theory] do some kind of zero knowledge proof or whatever that the plaintext belonging to a given ciphertext does [not] have a certain property? Here is my encrypted message and the proof that it does not contain some illegal content. Whether you would want such a system is another question, but it would at least be some middle ground between everything being encrypted and everything being [effectively] unencrypted.

LelouBil 3y ago
I don't know the feasibility of it, but the issue is that if this kind of system was implemented, I don't think it would *only* allow detecting CSAM. And that's the problem
- danbruc 3y ago
  I was imagining that you provide the proof, for example that none of the files you are sending has a hash that is on a certain list of illegal files. They would not be detecting anything, you would provide a cryptographically verifiable proof that whatever you are sending meets certain criteria. A server could then refuse to transport your encrypted message if it is not accompanied by a proof that the content is benign. There is of course the danger that they could change or expand what you have to prove in order to not get your message dropped. I think it might be possible to build something like that but I also think that it would probably in general require something like fully homomorphic encryption and therefore is not currently practical.
  - LelouBil 3y ago
    So like, maybe you could build a secure encryption algorithm that has a specific property X *only* when one of the images on some list is encrypted with it ?
ogurechny 3y ago
Imagine giant, mile-wide traps into which hordes of people gleefully run and fall. The talks about this being a “technical problem”, “legal problem”, “responsibility problem” are such obvious traps preventing people from getting the clear view. The ability to control, to have the last word on what is acceptable by someone else is the goal here. The construction of hierarchy attracts all kinds of actors, big and small, who see “opportunities” for themselves there. It is safe to assume that all that crowd couldn't care less about all the children in the world. The question to ask yourself is why such demands are not shrugged off like the others.
matthewdgreen 3y ago
You could. However, this would require the prover to know how to evaluate the property -- in other words, the test for CSAM would have to be publicly-known, or at least known to the client. This is not what providers and law enforcement want, since this would amount to giving away an algorithm that smart criminals could use to pre-test their content to see if it'll trip CSAM filters. To date, organizations have been extremely cagey about giving out content hashes for CSAM as well as even the algorithms for computing them, like PhotoDNA (which recently leaked.) The more recent proposals use two-party computation so that the client doesn't know whether any given piece of content matches. You can attach ZK proofs to the client's piece of this computation, all at fairly large (computational) cost.

LelouBil 3y ago

I don't know the feasibility of it, but the issue is that if this kind of system was implemented, I don't think it would *only* allow detecting CSAM. And that's the problem

danbruc 3y ago
I was imagining that you provide the proof, for example that none of the files you are sending has a hash that is on a certain list of illegal files. They would not be detecting anything, you would provide a cryptographically verifiable proof that whatever you are sending meets certain criteria. A server could then refuse to transport your encrypted message if it is not accompanied by a proof that the content is benign. There is of course the danger that they could change or expand what you have to prove in order to not get your message dropped. I think it might be possible to build something like that but I also think that it would probably in general require something like fully homomorphic encryption and therefore is not currently practical.
- LelouBil 3y ago
  So like, maybe you could build a secure encryption algorithm that has a specific property X *only* when one of the images on some list is encrypted with it ?

ogurechny 3y ago

Imagine giant, mile-wide traps into which hordes of people gleefully run and fall. The talks about this being a “technical problem”, “legal problem”, “responsibility problem” are such obvious traps preventing people from getting the clear view. The ability to control, to have the last word on what is acceptable by someone else is the goal here. The construction of hierarchy attracts all kinds of actors, big and small, who see “opportunities” for themselves there. It is safe to assume that all that crowd couldn't care less about all the children in the world. The question to ask yourself is why such demands are not shrugged off like the others.

matthewdgreen 3y ago

You could. However, this would require the prover to know how to evaluate the property -- in other words, the test for CSAM would have to be publicly-known, or at least known to the client. This is not what providers and law enforcement want, since this would amount to giving away an algorithm that smart criminals could use to pre-test their content to see if it'll trip CSAM filters. To date, organizations have been extremely cagey about giving out content hashes for CSAM as well as even the algorithms for computing them, like PhotoDNA (which recently leaked.) The more recent proposals use two-party computation so that the client doesn't know whether any given piece of content matches. You can attach ZK proofs to the client's piece of this computation, all at fairly large (computational) cost.