4 ms·

The thing is, if you are using deniable encryption and keep producing keys that reveal innocent data, the government will just keep demanding keys from you. Ba

The thing is, if you are using deniable encryption and keep producing keys that reveal innocent data, the government will just keep demanding keys from you. Basically, you have to be able to last until they give up -- but the odds are already against you on that. As for the hypothetical scenario, that is actually something that happened in real life: https://en.wikipedia.org/wiki/In_re_Boucher https://en.wikipedia.org/wiki/In_re_Boucher In real life it is somewhat unusual for the government to grab random people off the street and demand plaintexts. There is going to already be some kind of evidence against you, something to make the government suspicious. Maybe you attended an antiwar protest. Maybe you published a book about how to molest children. Maybe you are connected to some kind of fraud. Maybe a cop saw what appeared to be child pornography on your monitor. If the government is asking for your passphrase, it is because they already expect to find incriminating files; they will not just shrug and say, "We goofed!" when they see a deniable encryption system producing innocent files.

dllthomas 13y ago
I think the typical solution is to have something embarrassing but not incriminating (or incriminating, but for a lesser charge) for the last password you give up.
- betterunix 13y ago
  I doubt that would cut it. If the police are expecting you to reveal spreadsheets detailing your real estate fraud, and your deniable encryption system outputs some embarrassing fetish porn, the police are going to ignore the porn and demand your other key. Why should they believe you about the embarrassing files being the real or only reason you are using deniable encryption? Why would they not simply assume that you put those files there as part of an attempt to develop a plausible excuse? The real problem here is that, in a way, using deniable encryption is itself incriminating unless everyone uses it -- and we do not live in such a world. Unlike other cryptosystems, it is hard to develop a "legitimate" reason for using deniable encryption, as it has no particular advantage in protecting data from criminals over non-deniable encryption.
  - dllthomas 13y ago
    It's all about reducing the likelihood. Keeping my fetish porn hidden behind legitimate looking encrypted whatever is not an absurd story, so a chunk of the probability moves that way, leaving it correspondingly less likely that the deniable-encryption-supporting encrypted file here also contains the thing they were looking for. Whether it's less likely enough depends on a whole ton of things.
  - hamburglar 13y ago
    > [deniable encryption] has no particular advantage in protecting data from criminals over non-deniable encryption. Sure it does, in that the criminals can't see the attack target or even be sure one exists.
  - PeterisP 13y ago
    The purpose and usage of deniable encryption is not for police to stop demanding the other key. They may or may not stop, you can't control that. However, if you simply refuse to provide any more keys (regardless if such keys exists); then their only recourse is to try and convict you for not providing the key - and there, on a trial by a layman jury, the plausibility of whatever excuse you [didn't] provide would matter a great deal.
hamburglar 13y ago
While there is a sort of a "when do you stop asking for keys" problem, that doesn't mean they will necessarily be able to compel you to provide that final key you don't want them to have. The fact that they haven't gotten what they're after yet is not evidence that you have more keys, because it's indistinguishable from the case where you've simply already deleted the files. I'm not expecting them to shrug and say "we goofed", I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find. If they can prove the files exist and you're refusing to give them up, then that's something they can charge you with, but as I indicated earlier, that's a different kettle of fish. The big risk with deniable encryption, of course, is that the courts don't really understand it well and you end up in a situation where they are compelling you to provide information that actually does not exist (they think it's on a hidden aspect but they're wrong), and are willing to throw you in jail for not producing it. This risk is what leads me to the conclusion that the law must acknowledge that compelling complete decryption of all data is impossible.
- betterunix 13y ago
  "The fact that they haven't gotten what they're after yet is not evidence that you have more keys, because it's indistinguishable from the case where you've simply already deleted the files." Perhaps, but then why not just provide no key at all and rely on the semantic security of the cryptosystem? If you need to give the court a reason why you are not producing the secret key, you can always claim to have forgotten it. How does deniable encryption improve over that, if in the end it comes down to indistinguishability? "I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find." OK, but the same is true of non-deniable encryption when you say, "I forgot the key!" Anything that might lead them to believe otherwise would be equally applicable to deniable encryption. To put it another way, what is the difference between saying, "I only have this key," and saying, "I cannot remember the key at all?" In either case, you need to convince the police that there is no incriminating key they can demand from you.
  - 13y ago
spiritplumber 13y ago
Have three keys. Key one: Sanitized image. Turn this in immediately. Key two: Image with something that someone may consider embarassing, such as a few GB's of gay porn. Turn this in with great reluctance. Key three: Actual design documents, etc. Do not turn this in.

dllthomas 13y ago

I think the typical solution is to have something embarrassing but not incriminating (or incriminating, but for a lesser charge) for the last password you give up.

betterunix 13y ago
I doubt that would cut it. If the police are expecting you to reveal spreadsheets detailing your real estate fraud, and your deniable encryption system outputs some embarrassing fetish porn, the police are going to ignore the porn and demand your other key. Why should they believe you about the embarrassing files being the real or only reason you are using deniable encryption? Why would they not simply assume that you put those files there as part of an attempt to develop a plausible excuse? The real problem here is that, in a way, using deniable encryption is itself incriminating unless everyone uses it -- and we do not live in such a world. Unlike other cryptosystems, it is hard to develop a "legitimate" reason for using deniable encryption, as it has no particular advantage in protecting data from criminals over non-deniable encryption.
- dllthomas 13y ago
  It's all about reducing the likelihood. Keeping my fetish porn hidden behind legitimate looking encrypted whatever is not an absurd story, so a chunk of the probability moves that way, leaving it correspondingly less likely that the deniable-encryption-supporting encrypted file here also contains the thing they were looking for. Whether it's less likely enough depends on a whole ton of things.
- hamburglar 13y ago
  > [deniable encryption] has no particular advantage in protecting data from criminals over non-deniable encryption. Sure it does, in that the criminals can't see the attack target or even be sure one exists.
- PeterisP 13y ago
  The purpose and usage of deniable encryption is not for police to stop demanding the other key. They may or may not stop, you can't control that. However, if you simply refuse to provide any more keys (regardless if such keys exists); then their only recourse is to try and convict you for not providing the key - and there, on a trial by a layman jury, the plausibility of whatever excuse you [didn't] provide would matter a great deal.

hamburglar 13y ago

While there is a sort of a "when do you stop asking for keys" problem, that doesn't mean they will necessarily be able to compel you to provide that final key you don't want them to have. The fact that they haven't gotten what they're after yet is not evidence that you have more keys, because it's indistinguishable from the case where you've simply already deleted the files. I'm not expecting them to shrug and say "we goofed", I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find. If they can prove the files exist and you're refusing to give them up, then that's something they can charge you with, but as I indicated earlier, that's a different kettle of fish. The big risk with deniable encryption, of course, is that the courts don't really understand it well and you end up in a situation where they are compelling you to provide information that actually does not exist (they think it's on a hidden aspect but they're wrong), and are willing to throw you in jail for not producing it. This risk is what leads me to the conclusion that the law must acknowledge that compelling complete decryption of all data is impossible.

betterunix 13y ago
"The fact that they haven't gotten what they're after yet is not evidence that you have more keys, because it's indistinguishable from the case where you've simply already deleted the files." Perhaps, but then why not just provide no key at all and rely on the semantic security of the cryptosystem? If you need to give the court a reason why you are not producing the secret key, you can always claim to have forgotten it. How does deniable encryption improve over that, if in the end it comes down to indistinguishability? "I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find." OK, but the same is true of non-deniable encryption when you say, "I forgot the key!" Anything that might lead them to believe otherwise would be equally applicable to deniable encryption. To put it another way, what is the difference between saying, "I only have this key," and saying, "I cannot remember the key at all?" In either case, you need to convince the police that there is no incriminating key they can demand from you.
- 13y ago

spiritplumber 13y ago

Have three keys. Key one: Sanitized image. Turn this in immediately. Key two: Image with something that someone may consider embarassing, such as a few GB's of gay porn. Turn this in with great reluctance. Key three: Actual design documents, etc. Do not turn this in.