Crypto Experts Blast Gov't Backdoors For Encryption

loid_void writes with a link to a New York Times report about some of the world's best-known cryptography experts, who have prepared a report which concludes that there is no viable technical solution which "would allow the American and British governments to gain "exceptional access" to encrypted communications without putting the world's most confidential data and critical infrastructure in danger." From the article: [T]he government’s plans could affect the technology used to lock financial institutions and medical data, and poke a hole in mobile devices and the countless other critical systems — including pipelines, nuclear facilities, the power grid — that are moving online rapidly. ... “The problems now are much worse than they were in 1997,” said Peter G. Neumann, a co-author of both the 1997 report and the new paper, who is a computer security pioneer at SRI International, the Silicon Valley research laboratory. “There are more vulnerabilities than ever, more ways to exploit them than ever, and now the government wants to dumb everything down further.” The authors include Neumann, Harold Abelson, Susan Landau, and Bruce Schneier.

Comments

Re:They tried it before.

[gstoddart]

But now they have more secret "national security" laws which can be used to force it without people knowing or having the choice to reject it.

So you'd never know if they're demanding it from companies.

Re:Master key

[BBCWatcher]

Everybody who buys suitcases. https://www.tsa.gov/traveler-i...

Re: Falling on deaf ears

[Anonymous Coward]

The world has changed. Move the production where, Europe? Trade treaties will take care of that. Australia? Same thing. Russia? Sanctions. Asia? Treaties again. Governments are not like ordinary people, like you and me: if at first they don't succeed they bring out bigger and bigger weapons until they crush all the opposition. As with protests... Remember OWS? The gloves have come off. They don't have to hide anymore. Remember when being a journalist was almost an insurance policy? No more. They will use as much brutality as they see fit. And nobody will dare resist.

Re:Experts?

[ancientt]

I can't believe I'm going to contribute to this side of the discussion. "Loathe" is the mildest word I can think of for how I feel about a government accessible decryption system, but I'm going to explain why it's not infeasible to maintain security and have government access, unlike so many posters seem to assume.

Lets take cell phones as a starting example. The encryption of my phone isn't done with the password I put into the phone when I reboot it, the encryption is done with a randomly generated key which my password decrypts. There is no reason the same key that is actually decrypting the phone couldn't be encrypted with a phone manufacturer password. That government mandated password would encrypt the real decryption key just like my password does, but the government password wouldn't change when I change the password I'm using.

Note the government password isn't the same for multiple phones, it's unique to each phone. The government password is a randomly generated complex string of numbers, letters and symbols and it's not stored on the phone.

The government password for my phone is created at OS installation time and then the phone manufacturer encrypts it with the public key provided by the government. Those encrypted password media are sent to the companies selling the phones and those companies keep that media physically secured.

The government must subpoena the key for a specific phone in order to decrypt its contents.

The government password is now protected by:
A) A PKI private key stored by a government agency
B) Physical security at a non-governmental agency
C) The somewhat abused but best available legal processes of our government

Encrypted computer drives work the same. The assumption in both scenarios is that people fall into one of these groups:
A) don't know it is there
B) use the system their device came with
C) don't understand how to change the system

That covers 99.999% of people, probably even 99.99% of criminals. I may repartition my drive and install varying operating systems, and I may install a different OS on my phone, but normal people don't. Even drug dealers and terrorists are unlikely to do that when there are far easier ways to avoid incrimination. The fact is we could have such a "backdoor" already in play and we wouldn't necessarily know about it. I'm geekier than most by far, and I don't recompile the kernel on my boot partition to make sure it matches the one that is actually there. Granted, I do tend to wipe drives and start fresh, but if Redhat and Canonical are compromised, the NSA is good enough at their jobs, that I'll probably never notice. Do you know for sure the signature of your running kernel matches the one that you could compile for yourself?