10 ms·

Schneier 5 days ago: "Ah, but that's the thing: You can't build a "back door" that only the good guys can walk through. Encryption protects against cybercrimin

Schneier 5 days ago: "Ah, but that's the thing: You can't build a "back door" that only the good guys can walk through. Encryption protects against cybercriminals, industrial competitors, the Chinese secret police and the FBI. You're either vulnerable to eavesdropping by any of them, or you're secure from eavesdropping from all of them. Back-door access built for the good guys is routinely used by the bad guys. In 2005, some unknown group surreptitiously used the lawful-intercept capabilities built into the Greek cell phone system. The same thing happened in Italy in 2006. In 2010, Chinese hackers subverted an intercept system Google had put into Gmail to comply with U.S. government surveillance requests. Back doors in our cell phone system are currently being exploited by the FBI and unknown others." http://www.cnn.com/2014/10/03/opinion/schneier-apple-encryption-hysteria/ http://www.cnn.com/2014/10/03/opinion/schneier-apple-encrypt...

higherpurpose 12y ago
There is also this research on the IETF standard for "lawful intercept" in routers: Exploiting Lawful Intercept to Wiretap the Internet https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-wp.pdf https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl...
csandreasen 12y ago
There are plenty of things you can do. Your passwords (or whatever authentication method you choose to use) are a "back door" to get access to your device/accounts. What do you do to keep them secure? Your password can also be used be used by the bad guys - what do you do to reduce the chance of that happening and mitigate damage if it does happen? Now instead of thinking how you protect your own information, come up with ways concerning how you would protect your neighbor's, neighborhood's, city's, etc. and work your way up. Implementing the "back door" might be a difficult problem, but stating a priori that it's an intractable problem is just lazy thinking.
- toyg 12y ago
  Let's not try to doublespeak our way out of this: a "backdoor" that is only in your mind and heavily hashed everywhere else is not a backdoor -- it's a front door of which only one person (you) holds the key. A backdoor is a backdoor is a backdoor: an entrance on which you have no visibility nor control. And this is exactly what a "golden key" would be, regardless of how it's implemented.
  - csandreasen 12y ago
    A backdoor is nothing more than a second means of accessing a system. We're already used to having secondary measures in place to access our accounts for our own use (i.e.: password recovery). There is no 100% solution - our own primary passwords are sometimes stolen, and password recovery measures are regularly abused as well. The issue really boils down to allowing authorized users to access the systems and reducing the risk of unauthorized users to get in. Like it or not, law enforcement officers with a valid warrant to search your device are authorized users. It's in the constitution. Once you get past that, the thing to look at is how do reduce the risk of 3rd parties or law enforcement officials without valid warrants gaining access.
    - toyg 12y ago
      > password recovery measures are regularly abused as well > how to reduce the risk of 3rd parties [...] gaining access. Don't you see the contradiction there? Our systems are already full of holes, so let's create some more...? You also assume I'm a US citizen, which I am not. The minute the US mandate backdoors to manufacturers, all governments will want in, including some very nasty customers. So what do you do next, have separate keys for each government and country-based firmware, i.e. even more holes? It's a slippery slope. "The thing to look at" is how to remove the capability for third parties to access your data, regardless of who they are. Say that tomorrow I'll wake up in Nazi Sweden (not terribly unlikely, seeing current Euro trends), I'd rather not have brownshirts with keys to all my data - would you?
      - csandreasen 12y ago
        I actually don't see the contradiction - our security systems are full of holes largely as a matter of convenience. We put in password recovery because we routinely forget passwords. We make stupid password recovery processes that involve mothers' maiden names because it would be too much of hassle to do something more secure like show up at Google HQ with three forms of ID. The police don't have the same usability requirements. They only need access to the data on your phone once; they're not opening it every 10 minutes of every day to check your SMS/e-mail/HN posts/etc. In addition, they also have the requirement that they can't be opening your device without a valid search warrant. Any system put in place to allow them access needs to be designed with conditions like these in mind. With regards to other countries, manufacturers are already required to comply with all laws in any country they operate in. I don't think Americans should have to make a decision as to whether or not their own law enforcement should have the ability to decrypt phones based on what Chinese police might do in their own country. If you're worried about brownshirts taking over your government, there's nothing preventing you from encrypting the data yourself - nothing prevented you from doing it before. There are legitimate reasons for law enforcement to search a device after being issued a valid warrant; same as your house, place of business, safe deposit boxes, etc. Strong encryption by default on hundreds of millions of devices on which people conduct much of their daily business is something new. Locks and safes will slow down an investigation, but never to the point of bringing it to a halt. Strong encryption will. Given how central these devices have become in our lives, I don't know that it makes much sense to prevent police from searching them when they are legitimately investigating an actual crime.
- csandreasen 12y ago
  I'll take the downvotes as indication that I failed in my appeal to HN to discuss potentially workable solutions instead of just dismissing the problem as impossible. I'll go ahead post my own possible solution in hopes of actually furthering discussion. A couple minutes of thought on the subject brings me to: 1) Have the device manufacturer, FBI and Federal Court system all create their own public/private key pairs. FBI and the courts publish their public keys; the device manufacturer includes their public key, the FBI's and the court's on each device. 2) Each of these organizations stores their private key in a their own central secure facility. The key is only to exist in airgapped systems, further encrypted using a secure multi-party scheme so that multiple people are needed any time the private keys are accessed. Include personnel vetting, logging, video cameras, secure vaults, etc. to add further security. 3) When the user selects their password, the storage media is encrypted using that password, and the password is stored in a separate location on the device encrypted using the FBI's public key, the device manufacturer's public key and finally the courts' public key. 4) When law enforcement needs to decrypt the phone, they request a warrant from the court. When the warrant is approved, they send a copy of the encrypted password to the court's secure facility. The court decrypts it using their private key and hands it back. 5) The FBI (or the court, whichever) brings a copy of the warrant and the partially decrypted password to the device manufacturer. If the device manufacturer wishes to contest the warrant, they go through the normal appeals process. If not, they decrypt again using their private key and hands the resulting encrypting password over to the FBI. 6) The FBI takes the resulting encrypted password back to their own secure facility and decrypts it once more using their own private key, giving them the plaintext password. They now have access to the device, and could only have done so with a valid warrant and further given a third party trusted by the suspect (the device manufacturer) a further say in whether or not to appeal the warrant. There's my quick solution. Feel free to further the discussion by critiquing or improving it rather than downvoting to oblivion.
  - delinka 12y ago
    And although this makes collusion more difficult, how does your plan prevent it? How can I, with my password and keys in my own controls, prevent rogue FBI agents colluding with corporate employees (through brides, blackmail, intimidation) and frightened judges ("can't let the terrorists win!" even though no one's convicted yet) from accessing my data that ultimately they have no business accessing? We've seen law enforcement abuse every form of power they've been handed (see National Security Letters for one example), so I don't trust them to Do What's Right. Ever.
- deleted 12y ago
  [deleted]
- vidarh 12y ago
  We mitigate through compartmentalisation: Instead of one password for everything, each user has different username/password combinations, and hopefully different passwords for most services they access. That is the key point here: The moment you introduce a backdoor you have painted a target on the parties that needs to hold those keys big enough to be seen from space. Meanwhile, with compartmentalised keys, some users accounts get compromised all the time, but no single leak is sufficient to get everyone.
johnvschmitt 12y ago
Even so, there are weaker links in the security chain: Carriers (mobile equivalent of ISP's) Your carrier has access to every URL you visit (http or https) and the entire packets sent to/from them (if http), regardless of the password on your phone. Those Carriers have been MORE THAN eager to bend over backwards & give up the farm to the feds. Just check Verizon, AT&T's history with NSA/FBI/etc. So, YES, the article is golden, Schneir is golden, but the fact that weaker links exists should still install vigilance & outrage amongst civil libertarians / freedom lovers. And, even if there are weaker links in the chain, we should still applaud & support strengthening any/all links, while still vigilant/aware of where the weakest link remains.
- philip1209 12y ago
  They're presumably not MITMing SSL, so they have access to every host you visit, e.g. foo.com, via DNS. On SSL they cannot see the URL - e.g. https://foo.com/secret https://foo.com/secret
  - DrStalker 12y ago
    They also know the volume of data being moved and the times it occurred, which could be useful information.
    - zaroth 12y ago
      Often the byte count is enough to determine the URL. It's also a key component of how BEAST et al are able to extract session keys.
  - elliotanderson 12y ago
    If not DNS, then via Server Name Indication (SNI) http://en.wikipedia.org/wiki/Server_Name_Indication http://en.wikipedia.org/wiki/Server_Name_Indication
  - johnvschmitt 12y ago
    You're absolutely correct. However, when you combine host + time + location data, all at once, on your phone, then your carrier indeed has TONS of data to spy on you, regardless of the encryption on the phone itself. All good points, & my only point was that while we strengthen each link in the chain, we can't assume we're secure while weaker links exist.
bren2013 12y ago
There is a subfield of cryptography called kleptography, which studies the "secure golden keys" talked about. The DUAL_EC_DRBG is a great example of how "golden keys" can be implemented securely, because the underlying problem is the same one that a lot of elliptic curve cryptosystems rely on. Only the NSA could predict the output of the generator with the same level of security as ECDH or ECDSA.
- rcxdude 12y ago
  >Only the NSA could predict the output of the generator with the same level of security as ECDH or ECDSA. Only the NSA could generate the key initially. After that, who knows who will get access to it? You still have the same fundamental problem as with all backdoors, you've just eliminated one that most of them have (the fact that they're crap enough that you don't even need the back-door key to access them).
  - pluma 12y ago
    IOW, it's not a technical problem, it's a social one. "The NSA" isn't a person. If "the NSA" has access to a backdoor that means there are possibly hundreds of people who have access to that backdoor, every single one being a mere human being. It's not a secure golden key in a glass box with the label "in case of emergency break glass". It's a note on a shared whiteboard in an open plan office.
- saganus 12y ago
  >Only the NSA could predict the output of the generator with the same level of security as ECDH or ECDSA. How do we know, and be sure that this is true?
  - saganus 12y ago
    I don't know why I got downvoted and I love how people don't give the slightest explanation.
- srcmap 12y ago
  How real is this issue? Isn't is true that today, I can easily clone iPhone's data by declaring I loss my phone and need to buy a new one and recover everything from iCloud? Isn't it just trivial for someone to "recover" your data by pretent to be you by court order, NSL or other means?
paganel 12y ago
> Encryption protects against cybercriminals, industrial competitors, the Chinese secret police and the FBI. And that assumes that FBI will continue to remain "the good guys" from now on. Looking at the institution's past deeds I'm not convinced that will be the case: http://en.wikipedia.org/wiki/Fred_Hampton#Raid_and_assassination http://en.wikipedia.org/wiki/Fred_Hampton#Raid_and_assassina... and http://en.wikipedia.org/wiki/Martin_Luther_King,_Jr.#FBI_surveillance_and_wiretapping http://en.wikipedia.org/wiki/Martin_Luther_King,_Jr.#FBI_sur... , just to name a few.
- LordKano 12y ago
  I don't consider them to be "the good guys", now. The examples you gave and several others, including instances of using agents provocateur to entrap people who only came to their attention because of lawful and peaceful anti-government activities. There have been numerous cases of informants working at the behest of the federal government being involved in some highly objectionable activities and direct involvement of federal agencies in the suppression of domestic dissidents.

higherpurpose 12y ago

There is also this research on the IETF standard for "lawful intercept" in routers: Exploiting Lawful Intercept to Wiretap the Internet https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-wp.pdf https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl...

csandreasen 12y ago

There are plenty of things you can do. Your passwords (or whatever authentication method you choose to use) are a "back door" to get access to your device/accounts. What do you do to keep them secure? Your password can also be used be used by the bad guys - what do you do to reduce the chance of that happening and mitigate damage if it does happen? Now instead of thinking how you protect your own information, come up with ways concerning how you would protect your neighbor's, neighborhood's, city's, etc. and work your way up. Implementing the "back door" might be a difficult problem, but stating a priori that it's an intractable problem is just lazy thinking.

toyg 12y ago
Let's not try to doublespeak our way out of this: a "backdoor" that is only in your mind and heavily hashed everywhere else is not a backdoor -- it's a front door of which only one person (you) holds the key. A backdoor is a backdoor is a backdoor: an entrance on which you have no visibility nor control. And this is exactly what a "golden key" would be, regardless of how it's implemented.
- csandreasen 12y ago
  A backdoor is nothing more than a second means of accessing a system. We're already used to having secondary measures in place to access our accounts for our own use (i.e.: password recovery). There is no 100% solution - our own primary passwords are sometimes stolen, and password recovery measures are regularly abused as well. The issue really boils down to allowing authorized users to access the systems and reducing the risk of unauthorized users to get in. Like it or not, law enforcement officers with a valid warrant to search your device are authorized users. It's in the constitution. Once you get past that, the thing to look at is how do reduce the risk of 3rd parties or law enforcement officials without valid warrants gaining access.
  - toyg 12y ago
    > password recovery measures are regularly abused as well > how to reduce the risk of 3rd parties [...] gaining access. Don't you see the contradiction there? Our systems are already full of holes, so let's create some more...? You also assume I'm a US citizen, which I am not. The minute the US mandate backdoors to manufacturers, all governments will want in, including some very nasty customers. So what do you do next, have separate keys for each government and country-based firmware, i.e. even more holes? It's a slippery slope. "The thing to look at" is how to remove the capability for third parties to access your data, regardless of who they are. Say that tomorrow I'll wake up in Nazi Sweden (not terribly unlikely, seeing current Euro trends), I'd rather not have brownshirts with keys to all my data - would you?
    - csandreasen 12y ago
      I actually don't see the contradiction - our security systems are full of holes largely as a matter of convenience. We put in password recovery because we routinely forget passwords. We make stupid password recovery processes that involve mothers' maiden names because it would be too much of hassle to do something more secure like show up at Google HQ with three forms of ID. The police don't have the same usability requirements. They only need access to the data on your phone once; they're not opening it every 10 minutes of every day to check your SMS/e-mail/HN posts/etc. In addition, they also have the requirement that they can't be opening your device without a valid search warrant. Any system put in place to allow them access needs to be designed with conditions like these in mind. With regards to other countries, manufacturers are already required to comply with all laws in any country they operate in. I don't think Americans should have to make a decision as to whether or not their own law enforcement should have the ability to decrypt phones based on what Chinese police might do in their own country. If you're worried about brownshirts taking over your government, there's nothing preventing you from encrypting the data yourself - nothing prevented you from doing it before. There are legitimate reasons for law enforcement to search a device after being issued a valid warrant; same as your house, place of business, safe deposit boxes, etc. Strong encryption by default on hundreds of millions of devices on which people conduct much of their daily business is something new. Locks and safes will slow down an investigation, but never to the point of bringing it to a halt. Strong encryption will. Given how central these devices have become in our lives, I don't know that it makes much sense to prevent police from searching them when they are legitimately investigating an actual crime.
csandreasen 12y ago
I'll take the downvotes as indication that I failed in my appeal to HN to discuss potentially workable solutions instead of just dismissing the problem as impossible. I'll go ahead post my own possible solution in hopes of actually furthering discussion. A couple minutes of thought on the subject brings me to: 1) Have the device manufacturer, FBI and Federal Court system all create their own public/private key pairs. FBI and the courts publish their public keys; the device manufacturer includes their public key, the FBI's and the court's on each device. 2) Each of these organizations stores their private key in a their own central secure facility. The key is only to exist in airgapped systems, further encrypted using a secure multi-party scheme so that multiple people are needed any time the private keys are accessed. Include personnel vetting, logging, video cameras, secure vaults, etc. to add further security. 3) When the user selects their password, the storage media is encrypted using that password, and the password is stored in a separate location on the device encrypted using the FBI's public key, the device manufacturer's public key and finally the courts' public key. 4) When law enforcement needs to decrypt the phone, they request a warrant from the court. When the warrant is approved, they send a copy of the encrypted password to the court's secure facility. The court decrypts it using their private key and hands it back. 5) The FBI (or the court, whichever) brings a copy of the warrant and the partially decrypted password to the device manufacturer. If the device manufacturer wishes to contest the warrant, they go through the normal appeals process. If not, they decrypt again using their private key and hands the resulting encrypting password over to the FBI. 6) The FBI takes the resulting encrypted password back to their own secure facility and decrypts it once more using their own private key, giving them the plaintext password. They now have access to the device, and could only have done so with a valid warrant and further given a third party trusted by the suspect (the device manufacturer) a further say in whether or not to appeal the warrant. There's my quick solution. Feel free to further the discussion by critiquing or improving it rather than downvoting to oblivion.
- delinka 12y ago
  And although this makes collusion more difficult, how does your plan prevent it? How can I, with my password and keys in my own controls, prevent rogue FBI agents colluding with corporate employees (through brides, blackmail, intimidation) and frightened judges ("can't let the terrorists win!" even though no one's convicted yet) from accessing my data that ultimately they have no business accessing? We've seen law enforcement abuse every form of power they've been handed (see National Security Letters for one example), so I don't trust them to Do What's Right. Ever.
deleted 12y ago
[deleted]
vidarh 12y ago
We mitigate through compartmentalisation: Instead of one password for everything, each user has different username/password combinations, and hopefully different passwords for most services they access. That is the key point here: The moment you introduce a backdoor you have painted a target on the parties that needs to hold those keys big enough to be seen from space. Meanwhile, with compartmentalised keys, some users accounts get compromised all the time, but no single leak is sufficient to get everyone.

johnvschmitt 12y ago

Even so, there are weaker links in the security chain: Carriers (mobile equivalent of ISP's) Your carrier has access to every URL you visit (http or https) and the entire packets sent to/from them (if http), regardless of the password on your phone. Those Carriers have been MORE THAN eager to bend over backwards & give up the farm to the feds. Just check Verizon, AT&T's history with NSA/FBI/etc. So, YES, the article is golden, Schneir is golden, but the fact that weaker links exists should still install vigilance & outrage amongst civil libertarians / freedom lovers. And, even if there are weaker links in the chain, we should still applaud & support strengthening any/all links, while still vigilant/aware of where the weakest link remains.

philip1209 12y ago
They're presumably not MITMing SSL, so they have access to every host you visit, e.g. foo.com, via DNS. On SSL they cannot see the URL - e.g. https://foo.com/secret https://foo.com/secret
- DrStalker 12y ago
  They also know the volume of data being moved and the times it occurred, which could be useful information.
  - zaroth 12y ago
    Often the byte count is enough to determine the URL. It's also a key component of how BEAST et al are able to extract session keys.
- elliotanderson 12y ago
  If not DNS, then via Server Name Indication (SNI) http://en.wikipedia.org/wiki/Server_Name_Indication http://en.wikipedia.org/wiki/Server_Name_Indication
- johnvschmitt 12y ago
  You're absolutely correct. However, when you combine host + time + location data, all at once, on your phone, then your carrier indeed has TONS of data to spy on you, regardless of the encryption on the phone itself. All good points, & my only point was that while we strengthen each link in the chain, we can't assume we're secure while weaker links exist.

bren2013 12y ago

There is a subfield of cryptography called kleptography, which studies the "secure golden keys" talked about. The DUAL_EC_DRBG is a great example of how "golden keys" can be implemented securely, because the underlying problem is the same one that a lot of elliptic curve cryptosystems rely on. Only the NSA could predict the output of the generator with the same level of security as ECDH or ECDSA.

rcxdude 12y ago
>Only the NSA could predict the output of the generator with the same level of security as ECDH or ECDSA. Only the NSA could generate the key initially. After that, who knows who will get access to it? You still have the same fundamental problem as with all backdoors, you've just eliminated one that most of them have (the fact that they're crap enough that you don't even need the back-door key to access them).
- pluma 12y ago
  IOW, it's not a technical problem, it's a social one. "The NSA" isn't a person. If "the NSA" has access to a backdoor that means there are possibly hundreds of people who have access to that backdoor, every single one being a mere human being. It's not a secure golden key in a glass box with the label "in case of emergency break glass". It's a note on a shared whiteboard in an open plan office.
saganus 12y ago
>Only the NSA could predict the output of the generator with the same level of security as ECDH or ECDSA. How do we know, and be sure that this is true?
- saganus 12y ago
  I don't know why I got downvoted and I love how people don't give the slightest explanation.
srcmap 12y ago
How real is this issue? Isn't is true that today, I can easily clone iPhone's data by declaring I loss my phone and need to buy a new one and recover everything from iCloud? Isn't it just trivial for someone to "recover" your data by pretent to be you by court order, NSL or other means?

paganel 12y ago

> Encryption protects against cybercriminals, industrial competitors, the Chinese secret police and the FBI. And that assumes that FBI will continue to remain "the good guys" from now on. Looking at the institution's past deeds I'm not convinced that will be the case: http://en.wikipedia.org/wiki/Fred_Hampton#Raid_and_assassination http://en.wikipedia.org/wiki/Fred_Hampton#Raid_and_assassina... and http://en.wikipedia.org/wiki/Martin_Luther_King,_Jr.#FBI_surveillance_and_wiretapping http://en.wikipedia.org/wiki/Martin_Luther_King,_Jr.#FBI_sur... , just to name a few.

LordKano 12y ago
I don't consider them to be "the good guys", now. The examples you gave and several others, including instances of using agents provocateur to entrap people who only came to their attention because of lawful and peaceful anti-government activities. There have been numerous cases of informants working at the behest of the federal government being involved in some highly objectionable activities and direct involvement of federal agencies in the suppression of domestic dissidents.