Rethinking Encryption

Despite the length of this article, I see no plan for the obvious rebuttal of terrorists: if you make whatsapp or some other app not end to end encrypted, the terrorists will make their own app. Its not difficult to generate your own symmetric key and use openssl to encrypt and decrypt information sent with that key. Sure, you can force apple to reveal the contents of the hard drive, but whats the difference if apple is the one generating the ciphertext or the terrorists own app is? The difference is consumer protection has backdoors, but the terrorist protection does not.

This is fundamentally a fight about the autonomy of the human mind, and what the government can command you to do with your own brain.

If you and a cohort were the last survivors of a dying tribe, with your own special language that no one understood, and you criminally conspired with them via written word, the government could not compel you to translate your messages just because they cannot understand them. That's the 5th Amendment in action, as you'd be creating testimony against yourself. The prosecution will have to pin you on some other charge, maybe a crime that you actually physically committed.

It's the same exact thing with encryption. It's a language that the government cannot understand, and cannot compel you to translate.

Now, to be fair, there is some wishy-washy here because the government desires not only to have compelled decryption, but to force companies to wiretap their own users. The later is not strictly a 5th Amendment violation - but it's the principle of the matter.

One day we'll have the ability to interface directly with our minds, and we need to draw the "stay the fuck out" line pretty damned clearly in the sand before that happens.

Any tool can be used to undo itself... if not directly then by proxy.

Uhh.. no. In fact it doesn't.

If your goal is to secure the entire internet via SSL or get people to use PGP signed emails in a mass market then the tremendous technical and cultural hurdles in place that create making a 'truly secure' implementation that gets widely accepted a near impossibility.

But if you goal is to secure the communication between trained people in a 'terrorist cell' or other small group then that is pretty easy. It's really as hard as you want it to be.

For example any decent programmer could write a program that utilizes a 'One Time Pad' of random data to encrypt communication. A program in a USB flash drive that is filled with randomly generated data and the program is all that would need to be exchanged ahead of time. The biggest challenge involved in that is making absolutely sure that the every section of the one time pad used is only used once and is destroyed afterwards. You don't need to really know anything about encryption or math or protocol details to make something like that work.

And if correctly done it'll be impossible to crack.

And we are dealing with threats and adversaries that are much more sophisticated then that. Even small terrorist groups are more often then not state-funded one way or another. Foreign threats are sophisticated enough to create their own encryption. Domestic threats and cartels are sophisticated to hire competent programmers to do work for them. Pedophiles are not idiots either. Many of them are talented technical people that will have no problem avoiding government backdoors in commercial software and hardware products.

The threats American face via encryption isn't that encryption is too strong. It's that Americans don't use it enough and don't use it properly.

I find the idea that Americans are under threat due to lack of backdoors a fallacious one. Legislating that backdoors need to put in place only increases threats.

The only thing that laws like that would accomplish is to make it illegal for Americans to be secure.

Take away legal ability to have secure software then it means that the only people who will have secure software is criminals. Criminalizing good software is never going to be productive.

By "cannot compel you to translate," you mean "must not compel" or "should not compel," because an entity that controls 11 aircraft carriers can compel you to translate whatever the hell they want you to.