Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

lauren.vortex.com

Post reply on HN
Print view View original

31–40 of 295 posts

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#31

Post by glenra »

santosha wrote: post #14
pron wrote: post #9

Earlier quoted context omitted.

Don't rely on government for anything? What are you talking about? Almost 100% of scientific research and 100% of infrastructure around the world is funded by government. Almost all of education, health and welfare around the world (though less so in the US) is run by government. A lot of people are suspicious of government, but such fundamental disdain toward and alienation from government are peculiar American (and…

'such fundamental disdain toward and alienation from government are peculiar American' This. If you're so unshakably convinced that a government full of people you vote for every four years is never going to work in your interests, you have serious problems.

> a government full of people you vote for every four years

You mean a government full of people I vote against every four years, right? I actually don't vote any more, but back when I did, the people I voted for were never the ones who won the election. (At least not at the national level. There might have been a local one, though not any I can recall offhand.)

But even if my favored candidate had ever won, there are good public choice reasons to think the system as a whole would resist serving my interests ahead of its own. We have a "government by the government, for the government" - a vast barnacle feeding off the economy, trying to take as many resources as it can without killing the host.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#32

Post by mistercow »

ttctciyf wrote: post #15
digitalsushi wrote: post #10

The only thing I get really spooked over, is that eventually it gets to a point where the government starts demanding passphrases for hard drives with no hidden encrypted partition. Am I being paranoid? Someone sensible please dilute my paranoia.

Realistically paranoid, I think. Best plan may be to create a small encrypted partition, and put some data on it, so you can give them the passphrase when asked. Don't forget the passphrase!

And what if they say "That data was obviously innocuous so there must be another encrypted partition"?

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#33

Post by Nursie »

venomsnake wrote: post #24
mtgx wrote: post #16

Earlier quoted context omitted.

Wouldn't that mean Google would have to build a system to automatically send each key, for every session, for every user, to the NSA? That would be an insane scenario.

Unless I am mistaken the throwaway PFS keys are derived from something. They just have to share it with NSA and they will do the rest. (I am not a serious cryptographer)

Yes, they could share the keys and/or key matter used for every session with the NSA, and the NSA could then decrypt the conversation. Or they could just send the NSA the plaintext logs.

There is literally no way to keep a conversation secret if one of the parties involved is compromised, because you're talking to a compromised party!

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#34

Post by click170 »

zokier wrote: post #11

There is just so much more to public key crypto than public web SSL/TLS.

This is what I was thinking.

This sounds more like certificates are broken than public key crypto.

Yes they can come to me for my private key, but that's a different issue, then at least they're coming to me and not going to some intermediary "trusted party".

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#35

Post by phlo »

cmircea wrote: post #17

I treat email in Gmail as publicly accessible, same for almost everything I do on the web casually. My business data lives in Amsterdam (Azure EU West), critical services we use are based in Europe. At least in my case I couldn't care less if the big US companies handed out SSL keys.

Azure is , as far as I'm aware, still run by Microsoft (a US company).

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#36

Post by rlpb »

A logical conclusion to this is that if/when governments start forcing people to supply them with their private keys, they will also start forcing companies producing encryption software to include backdoors.

At this point, I'm thankful that we have Free Software. With access to the source code, forcing the insertion of a backdoor is futile, since somebody else will fork and remove it. With Free Software, we'll still be capable of running our own encryption in a way that government intrusion will still be detectable by ourselves.

Unless, of course, governments then ban communication about backdoors, or instructions on removing them, or distributing source code altogether.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#37

Post by rdl »

1337biz wrote: post #25
rdl wrote: post #20

Sounds like not "the death of public key encryption" but the golden age of building technical controls into hardware/software which cannot be subverted by the operator, even in the face of a state agent with a gun. Assuming the right tech is developed and deployed, this is going to be far better for everyone in a few years. Yes, it will be shitty for a year or two, but by 2020, if we actually have real technical secu…

Situations like these probably rarely produce a real "winner". It is going to be an arms race between those favoring personal privacy and those favoring government snooping. Just keep in mind that government operates basically on an unlimited budget and has access to a wide range of harassment opportunities for non compliance in matters like these. This fact alone will keep them at least at a dead level with potentia…

No, it's a win because the government is not the only, and in most cases not the worst, threat.

Insiders (like Snowden and Manning, ironically) are one of the biggest threats. Being attacked by non-USG outsiders is a major threat ("hackers", state sponsored or not). Your business partners being hacked, or having lax security, is another threat. USG is probably near the bottom of the list of actual threats for most people, in terms of frequency; they just have the most amazing resources.

If the "evil NSA boogeyman" is enough to get people to finally care about security, that's great. It's like people preparing for zombies by buying water, freeze dried food, radios, shotguns, etc., when in fact they're at the same time preparing for the far more likely earthquake or civil insurrection.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#38

Post by phlo »

venomsnake wrote: post #24
mtgx wrote: post #16

Earlier quoted context omitted.

Wouldn't that mean Google would have to build a system to automatically send each key, for every session, for every user, to the NSA? That would be an insane scenario.

Unless I am mistaken the throwaway PFS keys are derived from something. They just have to share it with NSA and they will do the rest. (I am not a serious cryptographer)

In order to provide any forward secrecy, the PFS keys are generated randomly for each session. They are not derived from the certificate holder's RSA keys.

A snooping agency holding the private key of, say, Google would still need to intercept each connection and act as a man in the middle. Simply knowing the RSA key (either beforehand or afterwards) is not enough to decrypt PFS sessions.

*edit: Google would still be able to collect and hand over all session keys ever used to communicate with them. The NSA might then use those session keys to decrypt any corresponding session.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#39

Post by pnathan »

ReidZB wrote: post #22
EGreg wrote: post #6

Earlier quoted context omitted.

PFS and other Deniable encryption ( http://en.wikipedia.org/wiki/Deniable_encryption ) are great for deniability. However, they and everything else can be susceptible to unrelenting rubber-hose "cryptanalysis". ( http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis ) It is said that the goal of cryptography is to make the attacker resort to rubber-hose cryptanalysis, revealing their intentions. In those cases, the…

Any encryption scheme worth using will not be identifiable by a randomness test. Block ciphers like AES are designed specifically to model pseudorandom permutations (or, rather, this was one of their design goals); being able to distinguish them from truly-random data would be a rather frightening result. For more information, see "Is it possible to distinguish a securely-encrypted ciphertext from random noise?" at h…

Pretty sure what the poster meant was that if you have a file with random noise on the hard drive, that itself signals that something is encrypted.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#40

Post by chmodd »

rdl wrote: post #20

Sounds like not "the death of public key encryption" but the golden age of building technical controls into hardware/software which cannot be subverted by the operator, even in the face of a state agent with a gun. Assuming the right tech is developed and deployed, this is going to be far better for everyone in a few years. Yes, it will be shitty for a year or two, but by 2020, if we actually have real technical secu…

I hope it works out similarly to how proliferation of public wi-fi led to increased adoption of https.
Post reply on HN