5 ms·

It's identical to the drive being overwritten by actual random bits, which some people do, so I would say that doesn't count as a signature.

by gradys 13y ago

loup-vaillant 13y ago
Use Bayes theorem. Out of all the hard drives owned by private citizens, how many are encrypted (E), and how many contain a significant chunk of random bits (R)? Let's say you picked a hard drive at random, and noticed a significant chunk of seemingly random bits. Is it encryption, or not? Well, given what you know, the best you can do is assign E÷(E+R) probability for the drive being encrypted. Now change the problem, where you suspect the owner of the drive may have reasons to encrypt it (suspicion of child porn fits perfectly). Random chunks are now even more suspect. Personally, I suspect that the vast majority of seemingly random chunks of bits are in fact encrypted data (meaning, E÷(E+R) is quite close to 1). So, while it's not proof, while it's not a signature, while for various reasons it's not something we want courts to use as an argument, it's still damn strong evidence that encryption is going on.
- talaketu 13y ago
  So, you are evaluating the probability that this drive is encrypted by taking the ratio of E/(E+R), where E and R are frequencies? This is simple probability, and does not involve Bayes Theorem at all. But how do you determine the frequencies E and R (or their ratio)? Perhaps you could sample the population of drives (E+R) and decide which of these are encrypted, and which are just randomized. And how to decide? Oh... you can't.
  - loup-vaillant 13y ago
    Forget about Bayes Theorem. I meant Bayesian Probability Theory, as described in Probability Theory: the Logic of Science by E. T. Jaynes. My point was just that to me, noticing in a hard drive a big seemingly random chunk of bytes is very strong Bayesian evidence that the disk holds encrypted data. And if there is encrypted data, the owner of the disk is more likely than not able to access it. > But how do you determine the frequencies E and R (or their ratio)? Just ask people in non-adverse situations. With enough effort, that should get you a decent probability distribution over the possible frequencies of E and R.
    - talaketu 13y ago
      this is like a placebo pregnancy test. "oh... you are taking a pregnancy test? then you are probably pregnant."
      - loup-vaillant 13y ago
        Well… exactly. When you learn that a given woman has taken a pregnancy test, your probability that she is in fact pregnant goes up. However, her probability is not affected by her taking the test: she takes the test for a reason, so merely taking actual action doesn't give her any meaningful information. Only the result of the test will tell her anything. Similarly, if we're talking about your wife, you most likely know when she has sex (because it's with you), and maybe she tells you about her period and such. In this case, merely learning that she took a pregnancy test doesn't tell you anything you don't know.

It's identical to the drive being overwritten by actual random bits, which some people do, so I would say that doesn't count as a signature.

by gradys 13y ago

It's identical to the drive being overwritten by actual random bits, which some people do, so I would say that doesn't count as a signature.

loup-vaillant 13y ago

Use Bayes theorem. Out of all the hard drives owned by private citizens, how many are encrypted (E), and how many contain a significant chunk of random bits (R)? Let's say you picked a hard drive at random, and noticed a significant chunk of seemingly random bits. Is it encryption, or not? Well, given what you know, the best you can do is assign E÷(E+R) probability for the drive being encrypted. Now change the problem, where you suspect the owner of the drive may have reasons to encrypt it (suspicion of child porn fits perfectly). Random chunks are now even more suspect. Personally, I suspect that the vast majority of seemingly random chunks of bits are in fact encrypted data (meaning, E÷(E+R) is quite close to 1). So, while it's not proof, while it's not a signature, while for various reasons it's not something we want courts to use as an argument, it's still damn strong evidence that encryption is going on.

talaketu 13y ago
So, you are evaluating the probability that this drive is encrypted by taking the ratio of E/(E+R), where E and R are frequencies? This is simple probability, and does not involve Bayes Theorem at all. But how do you determine the frequencies E and R (or their ratio)? Perhaps you could sample the population of drives (E+R) and decide which of these are encrypted, and which are just randomized. And how to decide? Oh... you can't.
- loup-vaillant 13y ago
  Forget about Bayes Theorem. I meant Bayesian Probability Theory, as described in Probability Theory: the Logic of Science by E. T. Jaynes. My point was just that to me, noticing in a hard drive a big seemingly random chunk of bytes is very strong Bayesian evidence that the disk holds encrypted data. And if there is encrypted data, the owner of the disk is more likely than not able to access it. > But how do you determine the frequencies E and R (or their ratio)? Just ask people in non-adverse situations. With enough effort, that should get you a decent probability distribution over the possible frequencies of E and R.
  - talaketu 13y ago
    this is like a placebo pregnancy test. "oh... you are taking a pregnancy test? then you are probably pregnant."
    - loup-vaillant 13y ago
      Well… exactly. When you learn that a given woman has taken a pregnancy test, your probability that she is in fact pregnant goes up. However, her probability is not affected by her taking the test: she takes the test for a reason, so merely taking actual action doesn't give her any meaningful information. Only the result of the test will tell her anything. Similarly, if we're talking about your wife, you most likely know when she has sex (because it's with you), and maybe she tells you about her period and such. In this case, merely learning that she took a pregnancy test doesn't tell you anything you don't know.