4 ms·

The proposed scheme would carry substantial expense compared to a single key. If Apple (for example) hosts the escrow keys, then who pays that cost? Who has the

The proposed scheme would carry substantial expense compared to a single key. If Apple (for example) hosts the escrow keys, then who pays that cost? Who has the right incentives to build a very costly but more secure system? I'm not saying it wouldn't be a good use of money, but it might make it difficult to build support for the idea. A cheaper solution which preserves much of the security would be to use cryptographic key-sharing rather than physical sharding. The escrow keys would still be created uniquely on a per-device basis, but now Apple, the FBI, and the Justice Department must each provide a fragment of the key. Perhaps the system could be designed to release keys only when provided with a valid warrant requesting a specific key... but this would probably require warrants to be better digitized.

bostik 12y ago
> The proposed scheme would carry substantial expense compared to a single key. If Apple (for example) hosts the escrow keys, then who pays that cost? Who has the right incentives to build a very costly but more secure system? I understood that was the whole point. If you're going to build a key escrow mechanism that isn't prone to universal, zero-effort abuse, there are going to be all kinds external factors that need to be considered. Ted's article lays out the requirements to show just how bad the idea of key escrow is, including the measures that would be necessary to make it acceptably insecure. (Key escrow is - and remains - defective by design.)