Live data from Hacker News

Government Announces Steps to Restore Confidence on Encryption Standards

bits.blogs.nytimes.com

51–60 of 132 posts

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#51
post #35

Before reading this, bear in mind, you wont find many more critical of government than me....That said I have to ask the following: How can any government accept a situation where communications are so secure that none of their agencies can break it? Essentially law enforcement do need to investigate crime. That has to be right and good for all. Even this anarchist accepts this. Such a situation is fine for "us", and…

I have absolutely no interest in forgetting the idea of secure communications just because governments won't like it.

I find it peculiar to see someone call themselves an anarchist yet accept this - unless you're a Proudhonist or other particularly esoteric pre-Bakunin kind that have been out of fashion since the 1870's...

A key feature of anarchism all the way back to when Bakunin was expelled from the first International by Marx over the issue of state authority has explicitly been the rapid destruction of the state as a critical element exactly because of the opportunity for oppression that lies inherent in the state. This is pretty much the dividing line between anarchism and marxist socialism/communism (the marxist standpoint is that a large scale working class uprising would enable the transformation of the state from a tool of oppression by the upper classes against the working class to a temporary tool of oppression by the working class against the upper classes, becoming obsolete as the working class subsumes the previously privileged classes), and also one of the major distinguishing features between anarchism and the various form of liberalism (in the classical sense, not the modern US sense) and libertarianism

The point being that the government does not serve you. It may quite regularly do things that overlap with your interests, but your influence on your government is disproportionally small in any situation where economic power buys you more attention from legislators per head than a vote does.

In that kind of situation, something that makes the government afraid is not something we should forget, but something to embrace and expand to help redress the balance.

Yes, it also helps 'the bad guys'. So does envelopes on your mail, the ability to freely lock your door and expect the police not to wander it at their leisure, or the ability to walk down the street without an id number stamped to your forehead. It would make things a lot easier for law enforcement if we all lived in prison already. Obviously we do not accept these things - it is not enough for something to benefit law enforcement for us to accept it.

> But to expect government to accept a situation where there is zero way they can snoop or investigate is asking a lot.

I see noone expecting government to accept such a situation, and even flawless information security for your communications does not create such a situation. You are setting up a strawman with this sentence.

> What is needed is a rock solid frame work and set of rules that properly limit how the snooping is done.

Rules don't stop people from doing something when the ability to monitor that they are actually complying is nearly non-existent.

> I'd suggest it should be developed by an international group, UN backed, and made part of being a member.

This is a very naive view of how the UN works. The very point of the UN is that it is inclusive - you don't exclude even the worst dictators because then you shut down communication. The upside is that this means there is a forum to make agreements amongst pretty much all the governments of the world. The downside is that you have to deal with these governments even when drafting agreements where "the good guys", if you can even come up with a cohesive list of who they would be, all agree to principles that would substantially improve things. Yes, it is infuriating whenever some dictatorship effectively shuts down some initiative, but it is the reality we have to live in as long as these regimes exist.

In other words, the UN will not do something like this because it goes directly counter to the interests of the governments of a large number of UN countries. And without substantial political upheaval it also goes counter to the interests of the governments of many democratic countries whose populations might prefer much stricter rules.

> Or could it be something that has to be agreed to as part of acquiring IP addresses or domain names. Dunno, but tie it in some how.

The current system for allocation of IP addresses and domain names only works because everyone voluntarily defers to the respective authorities. Even then, nothing but technical skills stops you, your grandma, or your government from setting up its own DNS roots, and nothing stops your ISP or your government from changing routing tables and allocate its own addresses.

They don't because it would break a lot of things, and because the current processes are sufficiently apolitical to not give them a reason to. If that changed, the internet would break into islands where not all parts can talk to all other parts without intermediaries.

This is why nobody has force the issue of tieing non-technical requirements to allocations of IP addresses or domains any more than it is in anyones interest to, say, withhold a country code for phone numbers from a dictatorship.

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#52
post #35

Before reading this, bear in mind, you wont find many more critical of government than me....That said I have to ask the following: How can any government accept a situation where communications are so secure that none of their agencies can break it? Essentially law enforcement do need to investigate crime. That has to be right and good for all. Even this anarchist accepts this. Such a situation is fine for "us", and…

> How can any government accept a situation where communications are so secure that none of their agencies can break it?

Does the government accept situation where it cannot read your own thoughts? How is that different?

You could make the same argument about crime fighting here. If we could read thoughts, well, then there would be no unsolvable crime really. But is it desirable?

So, no, even anarchists won't agree (neither me, and I am not an anarchist). The privacy comes to moral consideration too. Secret communication has no effect on the real world unless the people communicating actually act. Just like thoughts have no effect on the real world, unless you act. That's why we don't punish thoughts, but acts, and by that extension, we shouldn't punish communication, just acting based on that communication. Since these acts take place in the real world, criminal investigation is not obstructed.

Edit: Maybe a clarification. You could make an argument that if you don't know communication between people, then it's harder to convict a specific person rather than just the group. But the same is true for private communication (it was always a problem, even before electronic communications), and is also true for communication between neurons (we cannot be sure if person acted willingly or is a psychiatric case).

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#53

This got my heart beating. There is actual rebellion among academics, and a movement to restore trust in both people and tech. This is the NY Times quoting Matt Green of John Hopkins in the article: “I know from firsthand communications that a number of people at N.I.S.T. feel betrayed by their colleagues at the N.S.A.,” Mr. Green said in an interview Tuesday. Thats pretty strong sentiment. Seems to echo the bitterne…

“I know from firsthand communications that a number of people at N.I.S.T. feel betrayed by their colleagues at the N.S.A.,” Mr. Green said in an interview Tuesday.

That's the understatement of the century. NIST is pissed off. Many of these guys move fluidly back and forth from NSA, and clearly they were kept in the dark.

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#54
post #7

With RC4 being used to mitigate beast, we need a solution soon for the web, because RC4 is falling apart http://www.isg.rhul.ac.uk/tls/

Clients mitigate BEAST. RC4 is only a stopgap for ancient clients that don't have BEAST workarounds.

There is a solution, TLS 1.1 and 1.2. Because of slow server-side adoption, clients will have to keep supporting TLS 1.0 for quite a while. Because clients can't drop support for TLS 1.0, there's no strong incentive for server administrators to ensure their servers support TLS 1.1 and 1.2.

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#55
post #26

This is a procedural, not technical problem. It almost seems like the standardisation process open to everyone just enables everyone to insert their own backdoors into the standard. One interesting way to solve the problem would be to allow differenct mutually hostile entities to define their own standards (US, Russia, China, FSF, Pirate Bay, whoever) and then encrypt using all of them. That way, even if there is bac…

I think something like W3C would be better.

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#56
post #53

This got my heart beating. There is actual rebellion among academics, and a movement to restore trust in both people and tech. This is the NY Times quoting Matt Green of John Hopkins in the article: “I know from firsthand communications that a number of people at N.I.S.T. feel betrayed by their colleagues at the N.S.A.,” Mr. Green said in an interview Tuesday. Thats pretty strong sentiment. Seems to echo the bitterne…

“I know from firsthand communications that a number of people at N.I.S.T. feel betrayed by their colleagues at the N.S.A.,” Mr. Green said in an interview Tuesday. That's the understatement of the century. NIST is pissed off. Many of these guys move fluidly back and forth from NSA, and clearly they were kept in the dark.

Let's see how they dramatically improve the process then. I hope they don't think statements like "we didn't do it, trust us" are enough.

But it's probably best to just forget about NIST and start from scratch with a new standards body with zero influence from the government - any government(how it should be).

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#57
post #35

Before reading this, bear in mind, you wont find many more critical of government than me....That said I have to ask the following: How can any government accept a situation where communications are so secure that none of their agencies can break it? Essentially law enforcement do need to investigate crime. That has to be right and good for all. Even this anarchist accepts this. Such a situation is fine for "us", and…

> How can any government accept a situation where communications are so secure that none of their agencies can break it?

The way they accept every other fact of life that they cannot change.

The genie is out of the bottle now. Strong encryption exists; government cannot break it, and "bad actors" will use it. Law enforcement do need to investigate crime, but they need to do it in the real world not in the world of make believe. If that means they have to go back to older, harder investigative methods then life will go on.

The "alternative" that our governments seem to have chosen is unconscionable... They break their own laws, forsake their own principles and corral their own people into virtual concentration camps.

In their desperation they have seized total control, and then "restrained themselves" to simulate the capabilities they might have had in the good old days. Their self-restraint is admirable, but our societies are founded on law and democracy, not built on trust in the good natures of absolute rulers.

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#58
post #55
post #26

This is a procedural, not technical problem. It almost seems like the standardisation process open to everyone just enables everyone to insert their own backdoors into the standard. One interesting way to solve the problem would be to allow differenct mutually hostile entities to define their own standards (US, Russia, China, FSF, Pirate Bay, whoever) and then encrypt using all of them. That way, even if there is bac…

I think something like W3C would be better.

W3C or IETF are open by their nature. Thus, there can be multiple backdoors inserted by multiple parties. So if you use multiple such standards to encrypr, it may happen that there's an entity that has backdoor in all of them.

A standard from NSA, on the other hand, is guaranteed to have exactly one backdoor. Same goes for KGB etc.

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#59
post #26

This is a procedural, not technical problem. It almost seems like the standardisation process open to everyone just enables everyone to insert their own backdoors into the standard. One interesting way to solve the problem would be to allow differenct mutually hostile entities to define their own standards (US, Russia, China, FSF, Pirate Bay, whoever) and then encrypt using all of them. That way, even if there is bac…

  echo hello | crypt -usa | crypt -russia | crypt -china

Re: Government Announces Steps to Restore Confidence on Encryption Standards

#60
post #35

Before reading this, bear in mind, you wont find many more critical of government than me....That said I have to ask the following: How can any government accept a situation where communications are so secure that none of their agencies can break it? Essentially law enforcement do need to investigate crime. That has to be right and good for all. Even this anarchist accepts this. Such a situation is fine for "us", and…

> How can any government accept a situation where communications are so secure that none of their agencies can break it?

In a democracy? A system in which (at least in principle) the government is supposed to obey the laws and serve the needs of the people?

> Essentially law enforcement do need to investigate crime.

That logically breaks down to two questions: (1) Can the government listen in on anything it wants, and (2) does the government have that right? I won't presume to offer practical answers, but from a legal and constitutional standpoint, the answers are maybe and no.

> Even this anarchist accepts this.

An anarchist who accepts the government's right to listen in on anything ... isn't an anarchist. An anarchist who assumes that the government is doing that ... is a realist.

Post reply on HN