3 ms·

I wasn't personally suggesting that PATRIOT specifically compelled commercial enterprises to subvert cryptography, and we know from what's been leaked about BUL

I wasn't personally suggesting that PATRIOT specifically compelled commercial enterprises to subvert cryptography, and we know from what's been leaked about BULLRUN that at least some of the times that those activities occur, it's probably been upstream during (for example) standards development. It may, however, still be the case that PATRIOT creates a legal authority from which multiples agencies might ask companies to undermine some of the goals of cryptography--depending on your politics and your vantage point--to be able to profile lawful intercept capabilities, e.g. by offering unmonitored access through something like Google's eDiscovery portal or just by complying with legal requests.

tptacek 12y ago
I'm not commenting to defend NSA or, for that matter, cryptographic standards efforts. So: much of this comment is unresponsive to mine. What I'm interested in is, what's an example of some authority of PATRIOT compelling a commercial enterprise to weaken or subvert their cryptography or, as you put it, the goals of their cryptography? Be specific, please. This thread lead off with a truly wacky and false claim about compulsory key escrow. I'd prefer not to see it rehabilitated by a flight to abstraction and appeals to our shared dislike of NSA.
- justcommenting 12y ago
  I tend to think you're right and that we live in a world where key disclosure and various other methods of obtaining information from companies would be much more common than key escrow, especially key escrow implemented in response to a specific government request. I believe affected companies/people are typically gagged from discussing or even acknowledging the existence of--for example--an NSL demanding user data in the context of PATRIOT. My understanding was that the government--typically the FBI--could send NSLs to tech companies to secretly demand a broad range of user information, and short of being Tahoe-LAFS and it being impossible to fulfill such a request or being Lavabit and asking for money to build in a backdoor to fulfill such a request, companies had to find a way to comply. In other words, my understanding was more that PATRIOT created a legal authority that allowed the government to secretly demand user information in ways that made requests difficult to challenge in court or disclose to affected users, and that the technical and other specifics of how to satisfy those requests was typically up to the companies. I'm not aware of compelled key escrow (but also wouldn't necessarily expect to be given the role of gag orders), but Lavabit might be considered an example of compelled key disclosure. At least technically, that's a very different beast.

tptacek 12y ago

I'm not commenting to defend NSA or, for that matter, cryptographic standards efforts. So: much of this comment is unresponsive to mine. What I'm interested in is, what's an example of some authority of PATRIOT compelling a commercial enterprise to weaken or subvert their cryptography or, as you put it, the goals of their cryptography? Be specific, please. This thread lead off with a truly wacky and false claim about compulsory key escrow. I'd prefer not to see it rehabilitated by a flight to abstraction and appeals to our shared dislike of NSA.

justcommenting 12y ago
I tend to think you're right and that we live in a world where key disclosure and various other methods of obtaining information from companies would be much more common than key escrow, especially key escrow implemented in response to a specific government request. I believe affected companies/people are typically gagged from discussing or even acknowledging the existence of--for example--an NSL demanding user data in the context of PATRIOT. My understanding was that the government--typically the FBI--could send NSLs to tech companies to secretly demand a broad range of user information, and short of being Tahoe-LAFS and it being impossible to fulfill such a request or being Lavabit and asking for money to build in a backdoor to fulfill such a request, companies had to find a way to comply. In other words, my understanding was more that PATRIOT created a legal authority that allowed the government to secretly demand user information in ways that made requests difficult to challenge in court or disclose to affected users, and that the technical and other specifics of how to satisfy those requests was typically up to the companies. I'm not aware of compelled key escrow (but also wouldn't necessarily expect to be given the role of gag orders), but Lavabit might be considered an example of compelled key disclosure. At least technically, that's a very different beast.