Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ: Strong encryption that we don’t have access to is “unreasonable”

arstechnica.com

Post reply on HN
Print view View original

11–20 of 238 posts

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#11

Post by SomeStupidPoint »

olliej wrote: post #9
SomeStupidPoint wrote: post #7

Earlier quoted context omitted.

That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean…

We change key size because what is secure in terms of key size is literally compute bound. Key strength changes because we predict when a key will /cease being secure/. That said most of the demands made by DoJ aren't for reduced key size, they're for variations of key /escrow/: literally breaking the security model of crypto entirely. So maybe I could be more specific: there is no such thing as an almost secure prot…

> Key strength changes because we predict when a key will /cease being secure/.

Yes, we use keys up the gradient of security that key size represents as attacks become more powerful. The reason we don't use the more secure keys in the first place isn't that 2048b keys weren't always more secure than 1024b keys -- it's just that we didn't (for most purposes) need to be that secure, and so we choose an appropriate spot on the gradient for our cost-benefit analysis.

Pretending that's not a gradient of security is simply dishonest.

> That said most of the demands made by DoJ aren't for reduced key size, they're for variations of key /escrow/: literally breaking the security model of crypto entirely.

That's missing the plot for the details: the DoJ wants a method by which they can break into digital safes in a manner similar to physical safes. Their proposal is key escrow, but that's partly because technologists didn't suggest a better way when the DoJ simply asked to get it done with little guidance. So they made a specific ask. And it sucks -- because they're not technologists. Everyone knows it, but the DoJ isn't inclined to let people flat out refuse.

Pretending that there aren't technical solutions with transparent ruses -- like there aren't gradients of security -- are how we got to lawyers demanding technical features.

I don't disagree with you that we should use secure protocols, I'm just saying we need to hold ourselves accountable for honest and strong arguments, not ruses.

The one you end on -- that using ephemeral keys is fundamentally a stronger algorithm that doesn't work well with long term taps -- is a strong argument. Much better than things like "there aren't security gradients" -- partly because they're actually true.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#12

Post by SomeStupidPoint »

crankylinuxuser wrote: post #10
SomeStupidPoint wrote: post #7

Earlier quoted context omitted.

That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean…

To defend this user's point, I think could be a case made for a key escrow that requires an unlock from different organizations. RSA solved this years ago. We could establish a key escrow that adds a key to your personal key. This extra key would allow unsealing in cases where it would be needed within the law. The extra key could be set up so that it requires X out of Y keys. Each key could be owned by different org…

We can also require that the hardware issuer (eg, Apple) stores an encrypted copy of the key (throwing away the key used to encrypt the original key), such that it costs $1M (or other amount) to break the encryption and reveal the key.

There's no reason it shouldn't require expense and physical breaking to gain entry, just because it's digital (and I think that this scheme gains legal protection because of such features).

By actually discussing it, instead of hiding behind lies like "there are no security gradients", we can talk about systems where it would require X amount of compute effort to break an encrypted key held in escrow for Y years at Z expense to reveal the key. (I was actually thinking about using a hash chain to timelock the key, since we have a pretty good idea of how hard it is to sequentially hash.)

I don't think most of us are against the government being able to see individual, targeted encrypted drives -- I think we object to the ability to transparently compromise all systems.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#13

Post by olliej »

SomeStupidPoint wrote: post #7
olliej wrote: post #5

I wish this could be hammered into the thick heads of congress: there is secure, and there is insecure. There is not a gradient.

That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean…

I had another comment, but in response to your Ed: comment:

key size is not a measure of security. It is a measure of how /long/ we intend the key to be secure.

More explicitly: Key size does not exist of the gradient of protocol security. We know how long a key takes to break given current technology and algorithms. We choose a key size to render the time to break infeasible against our prediction of state of the art some amount of time in the future. If there's a gradient, the gradient isn't "how secure it is", its "how long it will remain secure".

Hence any policy that endeavours to control the "strength" of encryption through controls over key length is /necessarily/ requiring an insecure key size.

It can be put this simply: How small must the key be to allow it to be "good enough" for the DoJ? Would they accept a continuous 5 years on a 10000 gpus? Noting of course that in 18-24 months that key size will now only require 2.5 years, then 1.25, 7 months, 3 months...

Of course I'm sure 5 years and millions of dollars will be "unreasonable", so it would need to take less time, and cost less.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#14

Post by tzs »

If they want to convince me to accept some kind of back door in my encryption, they have to propose a system where it can be shown that it cannot be abused by bad actors within my government, and where there are clearly stated public rules about when it can be used.

It is possible to design such a system, where the probability of abuse is arbitrarily low [1], but I have a hard time imagining the current DOJ proposing such a thing.

[1] key escrow with access controlled by a multilevel secret sharing system that requires consensus among a diverse international group of shareholders to release the key from escrow. The shareholder group is chosen so that it includes a mix of public and private entities in a variety of jurisdictions, including anonymous shareholders, so that no entity can acquire enough power or influence to force a key to be revealed.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#15

Post by olliej »

SomeStupidPoint wrote: post #11
olliej wrote: post #9

Earlier quoted context omitted.

We change key size because what is secure in terms of key size is literally compute bound. Key strength changes because we predict when a key will /cease being secure/. That said most of the demands made by DoJ aren't for reduced key size, they're for variations of key /escrow/: literally breaking the security model of crypto entirely. So maybe I could be more specific: there is no such thing as an almost secure prot…

> Key strength changes because we predict when a key will /cease being secure/. Yes, we use keys up the gradient of security that key size represents as attacks become more powerful. The reason we don't use the more secure keys in the first place isn't that 2048b keys weren't always more secure than 1024b keys -- it's just that we didn't (for most purposes) need to be that secure, and so we choose an appropriate spot…

No one came up with a better "solution" than escrow because there is not one.

I've spent years of my life working on making it so people don't have to risk their information whenever it touches a computer.

Key length is a measure of how long you want the key to be secure. Also note that we tried that once in the past: DES had a deliberately crippled key space. That was resulting in terrible security bugs only a few years ago.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#16

Post by thatcat »

SomeStupidPoint wrote: post #7
olliej wrote: post #5

I wish this could be hammered into the thick heads of congress: there is secure, and there is insecure. There is not a gradient.

That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean…

I didn't downvote you, but ultimately either someone else can get in or they can't, the fact that keys have varying sizes is tangential to this issue since the size chosen only needs to be one that is sufficient. The fact that I don't know what that value is doesn't change the fact that the outcomes are binary (secure|insecure).

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#18

Post by SomeStupidPoint »

olliej wrote: post #13
SomeStupidPoint wrote: post #7

Earlier quoted context omitted.

That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean…

I had another comment, but in response to your Ed: comment: key size is not a measure of security. It is a measure of how /long/ we intend the key to be secure. More explicitly: Key size does not exist of the gradient of protocol security. We know how long a key takes to break given current technology and algorithms. We choose a key size to render the time to break infeasible against our prediction of state of the ar…

Sincere question: how do you define "how secure it is" except "how long it will remain secure (under attack)"?

Edit:

You're also completely eliding that security is probabilistic -- they might just guess our key on the first try. We can only discuss it as the expected amount of computation to figure out our key on average. That expected amount has a gradient along keysize.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#19

Post by olliej »

SomeStupidPoint wrote: post #12
crankylinuxuser wrote: post #10

Earlier quoted context omitted.

To defend this user's point, I think could be a case made for a key escrow that requires an unlock from different organizations. RSA solved this years ago. We could establish a key escrow that adds a key to your personal key. This extra key would allow unsealing in cases where it would be needed within the law. The extra key could be set up so that it requires X out of Y keys. Each key could be owned by different org…

We can also require that the hardware issuer (eg, Apple) stores an encrypted copy of the key (throwing away the key used to encrypt the original key), such that it costs $1M (or other amount) to break the encryption and reveal the key. There's no reason it shouldn't require expense and physical breaking to gain entry, just because it's digital (and I think that this scheme gains legal protection because of such featu…

Apple never has your keys to store.

That's kind of the point of end to end encryption. Note that on osx/ios that same e2e encryption protects credit card and password data.

Saying company X should store their keys is the same as saying "Company X should paint a giant target on their servers that have to be weakly protected to appease requests from agency Y". The solution to unending breaches of user data is to not be able to decrypt it, that only way to achieve that is to never have the keys.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#20

Post by kobeya »

tzs wrote: post #14

If they want to convince me to accept some kind of back door in my encryption, they have to propose a system where it can be shown that it cannot be abused by bad actors within my government, and where there are clearly stated public rules about when it can be used. It is possible to design such a system, where the probability of abuse is arbitrarily low [1], but I have a hard time imagining the current DOJ proposing…

> key escrow with access controlled by a multilevel secret sharing system that requires consensus among a diverse international group of shareholders to release the key from escrow. The shareholder group is chosen so that it includes a mix of public and private entities in a variety of jurisdictions, including anonymous shareholders, so that no entity can acquire enough power or influence to force a key to be revealed.

Intelligence agencies will just steal the keys, and then individual actors leak them onto the black market.

Post reply on HN