Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

European Union dedicated questionnaire on the Encryption of Data

blog.lukaszolejnik.com

Post reply on HN
Print view View original

101–110 of 113 posts

Re: European Union dedicated questionnaire on the Encryption of Data

#101

Post by kenoph »

strictnein wrote: post #74
kenoph wrote: post #28

Earlier quoted context omitted.

Is it? NIST has been putting backdoors in recommended encryption standards. USA State Department also classifies strong cryptography as a munition. As far as I know we don't do similar things in Europe (yet?), but I could be wrong.

Europe has dual-use tech export controls - http://www.wassenaar.org/ They're as meaningless as the American versions, only randomly ensnaring companies that sell to a doubleplus ungood entity. They don't do anything to stem the flow of crypto information or open source software to all parts of the globe. And that NIST thing happened possibly once. It's not a common ongoing occurrence.

DES is also believed to contain a backdoor. And even if it only happened once, I still don't see how "Europe is farther down this path than the US is currently".

Re: European Union dedicated questionnaire on the Encryption of Data

#102

Post by caf »

stale2002 wrote: post #100
semi-extrinsic wrote: post #98

Earlier quoted context omitted.

Like jbg said in another comment here, the legal system doesn't work that way, where the prosecution can claim you did stuff and you have to disprove the claim. The burden of proof is on the prosecution.

So you are agreeing with me that this tactic of plausible deniability with multiple encryption keys works then? Which is it? Does encryption allow you to hide from the law, or can innocent people just be proclaimed that they are hiding something and that they have to give up keys that don't exist? It is one or the other, because encryption plus multiple keys makes you 'indistinguishable' from an innocent person who t…

You're proposing a false dichotomy.

The tactic might work, but how well it would work would depend on what other evidence was presented that you do have another encrypted area. For example, if they analyse the partition you gave them the key to and show that it hasn't been booted in 18 months; they cross-reference the cached DHCP leases with the times you were known to have been online using that machine and find discrepancies; they might even have secretly imaged your disk a month earlier and show that a large amount of supposedly free space has changed content in the meantime.

(Maybe they even have you recorded telling someone that you have a second encrypted area on the machine.)

If there's no such evidence, then it ought to be pretty hard to convict you.

Re: European Union dedicated questionnaire on the Encryption of Data

#103

Post by strictnein »

kenoph wrote: post #101
strictnein wrote: post #74

Earlier quoted context omitted.

Europe has dual-use tech export controls - http://www.wassenaar.org/ They're as meaningless as the American versions, only randomly ensnaring companies that sell to a doubleplus ungood entity. They don't do anything to stem the flow of crypto information or open source software to all parts of the globe. And that NIST thing happened possibly once. It's not a common ongoing occurrence.

DES is also believed to contain a backdoor. And even if it only happened once, I still don't see how "Europe is farther down this path than the US is currently".

So England is going to just have all this fun by itself?

http://www.theverge.com/2016/11/23/13718768/uk-surveillance-...

They've actually had a law requiring you to decrypt on demand since 2007:

http://arstechnica.com/tech-policy/2007/10/uk-can-now-demand...

Nothing like that in the US at all. So, further down the path. France and Germany want similar laws.

http://www.reuters.com/article/europe-attacks-france-germany...

And other countries are joining in the call:

https://www.geektime.com/2016/11/26/5-eu-states-demand-bette...

Re: European Union dedicated questionnaire on the Encryption of Data

#104

Post by caf »

strictnein wrote: post #74
kenoph wrote: post #28

Earlier quoted context omitted.

Is it? NIST has been putting backdoors in recommended encryption standards. USA State Department also classifies strong cryptography as a munition. As far as I know we don't do similar things in Europe (yet?), but I could be wrong.

Europe has dual-use tech export controls - http://www.wassenaar.org/ They're as meaningless as the American versions, only randomly ensnaring companies that sell to a doubleplus ungood entity. They don't do anything to stem the flow of crypto information or open source software to all parts of the globe. And that NIST thing happened possibly once. It's not a common ongoing occurrence.

You quote that like Wassenaar is somehow a different thing to the US restrictions, but the US is a member of Wassenaar and ITAR is the USs implementation of it.

(So yes, to the broader point that all the Wassenaar countries implement very similar restrictions).

Re: European Union dedicated questionnaire on the Encryption of Data

#105

Post by caf »

kenoph wrote: post #101
strictnein wrote: post #74

Earlier quoted context omitted.

Europe has dual-use tech export controls - http://www.wassenaar.org/ They're as meaningless as the American versions, only randomly ensnaring companies that sell to a doubleplus ungood entity. They don't do anything to stem the flow of crypto information or open source software to all parts of the globe. And that NIST thing happened possibly once. It's not a common ongoing occurrence.

DES is also believed to contain a backdoor. And even if it only happened once, I still don't see how "Europe is farther down this path than the US is currently".

DES isn't widely believed to contain a backdoor. There were (a long time ago) questions about the changes the NSA made to the S-boxes, but it has since become apparent that these changes actually strengthened the cipher against differential cryptanalysis.

DES was weakened in a much more prosaic manner: the effective key size was reduced to 56 bits.

Re: European Union dedicated questionnaire on the Encryption of Data

#106

Post by caf »

matthewaveryusa wrote: post #90

I think this shows the state of our intel community. They've been focused on wide-net operations. If a target is high enough of an asset, why not go the easiest route of installing booby-trapped login screens, hardware keyloggers and what not? It's the easiest and most effective way to spy on someone (I'm sure they already do this.) This is all a ploy to spy on citizens. Period.

You can probably read into this that their political masters are asking questions like "why can't you tell us who these 'lone-wolves' are before they attack?".

Re: European Union dedicated questionnaire on the Encryption of Data

#107

Post by strictnein »

caf wrote: post #104
strictnein wrote: post #74

Earlier quoted context omitted.

Europe has dual-use tech export controls - http://www.wassenaar.org/ They're as meaningless as the American versions, only randomly ensnaring companies that sell to a doubleplus ungood entity. They don't do anything to stem the flow of crypto information or open source software to all parts of the globe. And that NIST thing happened possibly once. It's not a common ongoing occurrence.

You quote that like Wassenaar is somehow a different thing to the US restrictions, but the US is a member of Wassenaar and ITAR is the USs implementation of it. (So yes, to the broader point that all the Wassenaar countries implement very similar restrictions).

I was responding to the poster who wasn't sure if Europe had similar restrictions. Each country implements those agreements in unique ways, so my point was that everyone's implementation was basically pointless.

And, of course, the US's treatment of cryptography as munitions predates Wassenaar (the PGP case was previous to it, for instance), not sure about how everyone in Europe handled it prior to the agreement.

Re: European Union dedicated questionnaire on the Encryption of Data

#108

Post by kenoph »

strictnein wrote: post #103
kenoph wrote: post #101

Earlier quoted context omitted.

DES is also believed to contain a backdoor. And even if it only happened once, I still don't see how "Europe is farther down this path than the US is currently".

So England is going to just have all this fun by itself? http://www.theverge.com/2016/11/23/13718768/uk-surveillance-... They've actually had a law requiring you to decrypt on demand since 2007: http://arstechnica.com/tech-policy/2007/10/uk-can-now-demand... Nothing like that in the US at all. So, further down the path. France and Germany want similar laws. http://www.reuters.com/article/europe-attacks-france-germany…

Thanks for the pointers. I knew about the UK but I believe it is an exception in Europe rather than the rule, as of now. Of course I agree with you that probably most countries will try to get there, unfortunately. Then again, I can only read stuff written in my own language or English so I don't have the full view.

Re: European Union dedicated questionnaire on the Encryption of Data

#109

Post by jb613 »

devoply wrote: post #55
pmontra wrote: post #4

Smart criminals will use strong encryption anyway and won't give the passwords to law enforcement both for data at rest and sent over the Internet. I'm encrypting my disk now, but I'll give the password to police if they have a search warrant. I'm encrypting so if somebody steals my computer they won't read my data. I think that almost everybody is like me. Weakening that encryption doesn't help me and doesn't help i…

Backdoors and weakened encryption means that there is no encryption going on at all. If any government official can get any information that means anyone can get that information as many of the people who break this stuff don't work for governments and governments are least technically capable actors. So it means there is effectively no encryption all if encryption is weakened or backdoored.

There is a difference between weakened and backdoored. Weakened is along the lines what you're saying - that likely others than just the governments can easily access, whereas backdoored (if done properly) means only the govt. Of course, this assumes a perfect world and that there is a proper way to backdoor - in the real world, adversaries simply attack the governments backdoors/keys.

Nonetheless, given your context of "there is no encryption going on at all" I argue does not necessarily hold for a backdoor - or at least not at the outset and if done properly. If the govt backdoor is a key for which huge amount of care is taken to protect and take the extreme example of the govt encrypting the only copy of the key and firing it off in one direction into space - there is a backdoor but this is not necessarily equivalent to "no encryption at all".

Re: European Union dedicated questionnaire on the Encryption of Data

#110

Post by pgeorgi »

hannob wrote: post #95
pgeorgi wrote: post #91

Earlier quoted context omitted.

So which department shown on https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/BSI/Orga... has an offensive role? The BND/BSI split as implemented in Germany is relatively unique precisely to separate offensive and defensive concerns. The biggest issue IMHO is that they both report to the same federal office.

Here's some (german) background info on the role. The BSI assisted the BKA in creating a trojan, but tried to hide it from the public: https://netzpolitik.org/2015/geheime-kommunikation-bsi-progr...

I worked on SINA components in the past, so I know first hand what they're capable of and what some parts of the German tech media claimed they're used for. (tl;dr: there's very little overlap between some of the more popular claims and reality)

I suspect something similar happened here: BKA and some contractors build the trojan software. BVerfG requires that these tools are limited in their impact, and lawyers would also have a field day in court with any case where the software was used, if it can be shown to create security issues and so the BKA requests a security audit from the BSI (that's part of their charter) and gets it. That might have meant some code (in form of patches) flows back, but given that it's the BSI we're talking about, I doubt it.

Unfortunately the BSI is chartered to do security reviews for federal software, so they can't simply refuse. Meanwhile BSI officials are paranoid because they know (from the SINA/ISP surveillance FUD) what public reception of such a job looks like and tries to do PR management (and fails, which surprises probably no-one).

Post reply on HN