Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ: Strong encryption that we don’t have access to is “unreasonable”

arstechnica.com

Post reply on HN
Print view View original

161–170 of 238 posts

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#161

Post by matwood »

crankylinuxuser wrote: post #134
bhhaskin wrote: post #47

Earlier quoted context omitted.

I as a private citizen do not want the government to have access to my files. Period. End of story. They have zero right to have access to every aspect of my life. Any "solution" that involves any government the ability to access encrypted files is not encryption, but a lie.

And that's where I have to disagree. "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." 4th Amendment, Bill of Rights, US Constitution T…

I actually think for objects like phones, the 5th amendment should apply. Phones contain way more information about a person than any other medium in history. It contains so much information that I think we should consider it an extension of the person.

At some point we will have devices actually embedded in our bodies collecting every thought. Should those not be considered part of us and thus protected under the 5th amendment?

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#162

Post by Jotra7 »

cvwright wrote: post #95
olliej wrote: post #15

Earlier quoted context omitted.

No one came up with a better "solution" than escrow because there is not one. I've spent years of my life working on making it so people don't have to risk their information whenever it touches a computer. Key length is a measure of how long you want the key to be secure. Also note that we tried that once in the past: DES had a deliberately crippled key space. That was resulting in terrible security bugs only a few y…

> No one came up with a better "solution" than escrow because there is not one. I keep seeing this statement being made whenever this topic comes up. Yet I've never seen a formal impossibility result. It's amazing. Cryptographers are the smartest people in the world when it comes to solving most problems. (Just ask them!) But seriously, some of the stuff they can do is like magic. Things that, intuitively, sound like…

Spoken like someone who doesn't understand encryption.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#163

Post by AstralStorm »

garblegarble wrote: post #115
AstralStorm wrote: post #98

Earlier quoted context omitted.

Can't remember is a statement that can be disproven. Pleading non self incrimination laws (as per Miranda) is more effective. Even if you have nothing incriminating. This is what DoJ wants to close by making just possession of encrypted documents criminal. (Note: not a lawyer.)

>Can't remember is a statement that can be disproven It is? I'm not sure how you'd disprove it. Anecdotally (which I suppose actually matters in this case!) I've had a case where a (fairly long, 26 character) password I used regularly suddenly (and thus far, permanently!) went out of my head. I can remember some fragments of the password but not the whole thing.

If the prosecution has evidence you have recently logged in it will be all upto whether the jury believes you.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#164

Post by eeZah7Ux »

saas_co_de wrote: post #121
bradknowles wrote: post #75

Earlier quoted context omitted.

But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided? Answer: you can’t.

> Answer: you can’t. No, it is incredibly simple. You have a master key and the government holds this key on a secure audited system which can only be used to unlock a device once a court order is granted. The government's security for the master key will certainly be much better than the average user's password security so this will not decrease the average user's security in the least. You would also make the maste…

The "government master key" idea is silly (for a number of reasons).

Yet, it's very possible to share a copy of every user key using methods like Shamir's secret sharing - therefore requiring P out of N entities agreeing on allowing the decryption to happen.

The secrets can be shared in advance with attorneys, civil rights groups, government entities and allows a democratic-ish process around decryption.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#165

Post by saas_co_de »

eeZah7Ux wrote: post #164
saas_co_de wrote: post #121

Earlier quoted context omitted.

> Answer: you can’t. No, it is incredibly simple. You have a master key and the government holds this key on a secure audited system which can only be used to unlock a device once a court order is granted. The government's security for the master key will certainly be much better than the average user's password security so this will not decrease the average user's security in the least. You would also make the maste…

The "government master key" idea is silly (for a number of reasons). Yet, it's very possible to share a copy of every user key using methods like Shamir's secret sharing - therefore requiring P out of N entities agreeing on allowing the decryption to happen. The secrets can be shared in advance with attorneys, civil rights groups, government entities and allows a democratic-ish process around decryption.

> The "government master key" idea is silly (for a number of reasons).

all of the security experts advising law enforcement, intelligence agencies, and politicians seem to think it is pretty reasonable.

care to share any of your reasons for disagreeing with them?

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#166

Post by pdkl95 »

saas_co_de wrote: post #121
bradknowles wrote: post #75

Earlier quoted context omitted.

But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided? Answer: you can’t.

> Answer: you can’t. No, it is incredibly simple. You have a master key and the government holds this key on a secure audited system which can only be used to unlock a device once a court order is granted. The government's security for the master key will certainly be much better than the average user's password security so this will not decrease the average user's security in the least. You would also make the maste…

> government's security for the master key will certainly be much better

It's foolish to assume this after Snowden was able to walk away with his archive of classified documents. In his case, storing that many documents within the reach of one person risked losing the entire archive, which is exactly what happened. If literally everything depends on a government held escrow key, You've painted a target on a huge single-point failure.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#167

Post by jasomill »

garblegarble wrote: post #115
AstralStorm wrote: post #98

Earlier quoted context omitted.

Can't remember is a statement that can be disproven. Pleading non self incrimination laws (as per Miranda) is more effective. Even if you have nothing incriminating. This is what DoJ wants to close by making just possession of encrypted documents criminal. (Note: not a lawyer.)

>Can't remember is a statement that can be disproven It is? I'm not sure how you'd disprove it. Anecdotally (which I suppose actually matters in this case!) I've had a case where a (fairly long, 26 character) password I used regularly suddenly (and thus far, permanently!) went out of my head. I can remember some fragments of the password but not the whole thing.

I'd say the point is that the idea that the legal system suddenly has no way to deal with witnesses claiming forgetfulness "because encryption" is absurd.

The only novel issues encryption brings to the table involve self incrimination, because, AFAIK, IANAL, etc., the only time an encryption key is inarguably protected by the fifth amendment is where the fact that the defendant knows the key is itself incriminating evidence, because the fifth amendment only applies to self-incriminating testimony, not other self-incriminating evidence in the defendant's possession (e.g., the contents of a hard drive, encrypted or not).

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#168

Post by Sacho »

saas_co_de wrote: post #121
bradknowles wrote: post #75

Earlier quoted context omitted.

But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided? Answer: you can’t.

> Answer: you can’t. No, it is incredibly simple. You have a master key and the government holds this key on a secure audited system which can only be used to unlock a device once a court order is granted. The government's security for the master key will certainly be much better than the average user's password security so this will not decrease the average user's security in the least. You would also make the maste…

> You would also make the master keys expire regularly (maybe daily) so as long as a user updates their phone they will get updated with the new keys to protect against a leaked key.

What would the logistics of this be? Would the government need to store all master keys to be able to decrypt an old message? How would you know you're using the right key to decrypt a message? What happens if all the old keys leak?

What about foreign communications? You can't compel foreign actors to encrypt with your algorithm. What if I'm storing foreign data which is encrypted with illegal algorithms, is that going to be illegal? If so, then goodbye hosting services in the US. If not, how are you going to differentiate between foreign data and local data?

What about the transition period? What do you do with legacy encryption? What about people who haven't received the newly updated government-sanctioned encryption yet? What about old devices that can't run your encryption algorithm, closed systems, etc?

I don't think it's as incredibly simple as you put it.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#169

Post by nokcha »

I'd argue that any backdoored encryption (which renders the plaintext accessible to the government and to any other entity with access to the backdoor key) is inherently irresponsible. It introduces a single point of failure that will be routinely exposed in the course of ordinary criminal investigations. If US technology companies rely on this encryption to protect their trade secrets, then it's only a matter of time before China finds a way to exfiltrate the backdoor key.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#170

Post by [deleted] »

nokcha wrote: post #169

I'd argue that any backdoored encryption (which renders the plaintext accessible to the government and to any other entity with access to the backdoor key) is inherently irresponsible. It introduces a single point of failure that will be routinely exposed in the course of ordinary criminal investigations. If US technology companies rely on this encryption to protect their trade secrets, then it's only a matter of tim…

[deleted]
Post reply on HN