3 ms·

Deniable encryption only works if either (a) everyone is using it or (b) there is no way to tell if you are using it. I doubt you will ever see the former, and

Deniable encryption only works if either (a) everyone is using it or (b) there is no way to tell if you are using it. I doubt you will ever see the former, and that latter is pretty difficult -- even if such a scheme exists, you have to also hide the deniable encryption software you are using i.e. it is the classic warden problem. To put it another way, let's say you are using Truecrypt, and the prosecution can prove that you have incriminating documents on your laptop. You enter your "innocent" passphrase and behold! No incriminating documents. I think the next obvious move will be for the court to demand that you enter your other passphrase, leaving you trying to prove that you really were not using the distinguishing feature of Truecrypt. A better solution, where applicable, is to destroy keys as quickly as you can. Keep your keys on a smartcard, and self-destruct the card if you think you will be arrested. You will deny yourself access to your files, but you will also deny your adversary such access. The police might try to prove that you destroyed evidence, but that is much harder to prove if your own procedure is to periodically destroy your keys (and such a procedure can be done individually without raising suspicion). Basically it all comes down to opsec -- something the military has known for centuries.

hamburglar 13y ago
I'm talking about a deniable encryption scheme such as rubberhose, where the fact that you're using it is known, but it's impossible to tell whether you've revealed all the hidden aspects or not. "Here's my key." "Well, you're using deniable encryption; we need your other key." "Ok, here are my other two keys." But your hypothetical is also strange: "let's say ... the prosecution can prove that you have incriminating documents on your laptop." If the prosecution can prove that you have incriminating documents before you ever provide the keys, you're already screwed.
- betterunix 13y ago
  The thing is, if you are using deniable encryption and keep producing keys that reveal innocent data, the government will just keep demanding keys from you. Basically, you have to be able to last until they give up -- but the odds are already against you on that. As for the hypothetical scenario, that is actually something that happened in real life: https://en.wikipedia.org/wiki/In_re_Boucher https://en.wikipedia.org/wiki/In_re_Boucher In real life it is somewhat unusual for the government to grab random people off the street and demand plaintexts. There is going to already be some kind of evidence against you, something to make the government suspicious. Maybe you attended an antiwar protest. Maybe you published a book about how to molest children. Maybe you are connected to some kind of fraud. Maybe a cop saw what appeared to be child pornography on your monitor. If the government is asking for your passphrase, it is because they already expect to find incriminating files; they will not just shrug and say, "We goofed!" when they see a deniable encryption system producing innocent files.
  - dllthomas 13y ago
    I think the typical solution is to have something embarrassing but not incriminating (or incriminating, but for a lesser charge) for the last password you give up.
    - betterunix 13y ago
      I doubt that would cut it. If the police are expecting you to reveal spreadsheets detailing your real estate fraud, and your deniable encryption system outputs some embarrassing fetish porn, the police are going to ignore the porn and demand your other key. Why should they believe you about the embarrassing files being the real or only reason you are using deniable encryption? Why would they not simply assume that you put those files there as part of an attempt to develop a plausible excuse? The real problem here is that, in a way, using deniable encryption is itself incriminating unless everyone uses it -- and we do not live in such a world. Unlike other cryptosystems, it is hard to develop a "legitimate" reason for using deniable encryption, as it has no particular advantage in protecting data from criminals over non-deniable encryption.
      - dllthomas 13y ago
        It's all about reducing the likelihood. Keeping my fetish porn hidden behind legitimate looking encrypted whatever is not an absurd story, so a chunk of the probability moves that way, leaving it correspondingly less likely that the deniable-encryption-supporting encrypted file here also contains the thing they were looking for. Whether it's less likely enough depends on a whole ton of things.
      - hamburglar 13y ago
        > [deniable encryption] has no particular advantage in protecting data from criminals over non-deniable encryption. Sure it does, in that the criminals can't see the attack target or even be sure one exists.
      - PeterisP 13y ago
        The purpose and usage of deniable encryption is not for police to stop demanding the other key. They may or may not stop, you can't control that. However, if you simply refuse to provide any more keys (regardless if such keys exists); then their only recourse is to try and convict you for not providing the key - and there, on a trial by a layman jury, the plausibility of whatever excuse you [didn't] provide would matter a great deal.

hamburglar 13y ago

I'm talking about a deniable encryption scheme such as rubberhose, where the fact that you're using it is known, but it's impossible to tell whether you've revealed all the hidden aspects or not. "Here's my key." "Well, you're using deniable encryption; we need your other key." "Ok, here are my other two keys." But your hypothetical is also strange: "let's say ... the prosecution can prove that you have incriminating documents on your laptop." If the prosecution can prove that you have incriminating documents before you ever provide the keys, you're already screwed.

betterunix 13y ago
The thing is, if you are using deniable encryption and keep producing keys that reveal innocent data, the government will just keep demanding keys from you. Basically, you have to be able to last until they give up -- but the odds are already against you on that. As for the hypothetical scenario, that is actually something that happened in real life: https://en.wikipedia.org/wiki/In_re_Boucher https://en.wikipedia.org/wiki/In_re_Boucher In real life it is somewhat unusual for the government to grab random people off the street and demand plaintexts. There is going to already be some kind of evidence against you, something to make the government suspicious. Maybe you attended an antiwar protest. Maybe you published a book about how to molest children. Maybe you are connected to some kind of fraud. Maybe a cop saw what appeared to be child pornography on your monitor. If the government is asking for your passphrase, it is because they already expect to find incriminating files; they will not just shrug and say, "We goofed!" when they see a deniable encryption system producing innocent files.
- dllthomas 13y ago
  I think the typical solution is to have something embarrassing but not incriminating (or incriminating, but for a lesser charge) for the last password you give up.
  - betterunix 13y ago
    I doubt that would cut it. If the police are expecting you to reveal spreadsheets detailing your real estate fraud, and your deniable encryption system outputs some embarrassing fetish porn, the police are going to ignore the porn and demand your other key. Why should they believe you about the embarrassing files being the real or only reason you are using deniable encryption? Why would they not simply assume that you put those files there as part of an attempt to develop a plausible excuse? The real problem here is that, in a way, using deniable encryption is itself incriminating unless everyone uses it -- and we do not live in such a world. Unlike other cryptosystems, it is hard to develop a "legitimate" reason for using deniable encryption, as it has no particular advantage in protecting data from criminals over non-deniable encryption.
    - dllthomas 13y ago
      It's all about reducing the likelihood. Keeping my fetish porn hidden behind legitimate looking encrypted whatever is not an absurd story, so a chunk of the probability moves that way, leaving it correspondingly less likely that the deniable-encryption-supporting encrypted file here also contains the thing they were looking for. Whether it's less likely enough depends on a whole ton of things.
    - hamburglar 13y ago
      > [deniable encryption] has no particular advantage in protecting data from criminals over non-deniable encryption. Sure it does, in that the criminals can't see the attack target or even be sure one exists.
    - PeterisP 13y ago
      The purpose and usage of deniable encryption is not for police to stop demanding the other key. They may or may not stop, you can't control that. However, if you simply refuse to provide any more keys (regardless if such keys exists); then their only recourse is to try and convict you for not providing the key - and there, on a trial by a layman jury, the plausibility of whatever excuse you [didn't] provide would matter a great deal.