4 ms·

While there is a sort of a "when do you stop asking for keys" problem, that doesn't mean they will necessarily be able to compel you to provide that final key y

While there is a sort of a "when do you stop asking for keys" problem, that doesn't mean they will necessarily be able to compel you to provide that final key you don't want them to have. The fact that they haven't gotten what they're after yet is not evidence that you have more keys, because it's indistinguishable from the case where you've simply already deleted the files. I'm not expecting them to shrug and say "we goofed", I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find. If they can prove the files exist and you're refusing to give them up, then that's something they can charge you with, but as I indicated earlier, that's a different kettle of fish. The big risk with deniable encryption, of course, is that the courts don't really understand it well and you end up in a situation where they are compelling you to provide information that actually does not exist (they think it's on a hidden aspect but they're wrong), and are willing to throw you in jail for not producing it. This risk is what leads me to the conclusion that the law must acknowledge that compelling complete decryption of all data is impossible.

betterunix 13y ago
"The fact that they haven't gotten what they're after yet is not evidence that you have more keys, because it's indistinguishable from the case where you've simply already deleted the files." Perhaps, but then why not just provide no key at all and rely on the semantic security of the cryptosystem? If you need to give the court a reason why you are not producing the secret key, you can always claim to have forgotten it. How does deniable encryption improve over that, if in the end it comes down to indistinguishability? "I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find." OK, but the same is true of non-deniable encryption when you say, "I forgot the key!" Anything that might lead them to believe otherwise would be equally applicable to deniable encryption. To put it another way, what is the difference between saying, "I only have this key," and saying, "I cannot remember the key at all?" In either case, you need to convince the police that there is no incriminating key they can demand from you.
- hamburglar 13y ago
  This is a good question, and the differences are pretty small. One difference, although I'm not sure what the impact is of this difference, is that if you say you've forgotten the key, that's an acknowledgement that there is data there to be discovered, just that you can't provide access to it. Does this leave a door open to other efforts to decrypt it? I don't know.

betterunix 13y ago

"The fact that they haven't gotten what they're after yet is not evidence that you have more keys, because it's indistinguishable from the case where you've simply already deleted the files." Perhaps, but then why not just provide no key at all and rely on the semantic security of the cryptosystem? If you need to give the court a reason why you are not producing the secret key, you can always claim to have forgotten it. How does deniable encryption improve over that, if in the end it comes down to indistinguishability? "I'm expecting them to realize that with a well-designed deniable system, they can't tell the difference between you being uncooperative and there being nothing incriminating to find." OK, but the same is true of non-deniable encryption when you say, "I forgot the key!" Anything that might lead them to believe otherwise would be equally applicable to deniable encryption. To put it another way, what is the difference between saying, "I only have this key," and saying, "I cannot remember the key at all?" In either case, you need to convince the police that there is no incriminating key they can demand from you.

hamburglar 13y ago
This is a good question, and the differences are pretty small. One difference, although I'm not sure what the impact is of this difference, is that if you say you've forgotten the key, that's an acknowledgement that there is data there to be discovered, just that you can't provide access to it. Does this leave a door open to other efforts to decrypt it? I don't know.