Slashdot Mirror

← Back to Stories (view on slashdot.org)

Crypto Experts Blast Gov't Backdoors For Encryption

Posted by timothy on from the mr-potatohead-mr-potatohead dept.

loid_void writes with a link to a New York Times report about some of the world's best-known cryptography experts, who have prepared a report which concludes that there is no viable technical solution which "would allow the American and British governments to gain "exceptional access" to encrypted communications without putting the world's most confidential data and critical infrastructure in danger." From the article: [T]he government’s plans could affect the technology used to lock financial institutions and medical data, and poke a hole in mobile devices and the countless other critical systems — including pipelines, nuclear facilities, the power grid — that are moving online rapidly. ... “The problems now are much worse than they were in 1997,” said Peter G. Neumann, a co-author of both the 1997 report and the new paper, who is a computer security pioneer at SRI International, the Silicon Valley research laboratory. “There are more vulnerabilities than ever, more ways to exploit them than ever, and now the government wants to dumb everything down further.” The authors include Neumann, Harold Abelson, Susan Landau, and Bruce Schneier.

15 of 102 comments (clear)

  1. Falling on deaf ears by Anonymous Coward · · Score: 5, Insightful

    You cannot, under any circumstances, convince the government that having a backdoor into all those things is a bad thing.

    1. Re:Falling on deaf ears by ShanghaiBill · · Score: 5, Insightful

      You cannot, under any circumstances, convince the government that having a backdoor into all those things is a bad thing.

      But you can convince individuals that their privacy will not be protected, and you can convince companies that few will buy their products. The Clipper chip did not fail because the government was convinced, but because of a backlash from consumers that didn't want it, and from companies that threatened to move their production overseas. The current proposals will fail for the exact same reasons.

    2. Re:Falling on deaf ears by mwvdlee · · Score: 4, Insightful

      That's because backdoors give private information to governments at the cost of instilling justified fear in it's citizens.
      It's a win-win situation as far as they're concerned.

      --
      Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
    3. Re:Falling on deaf ears by wbr1 · · Score: 3, Informative

      That was before oogie boogie terrists. Most of the plebes will fall in line now. Witness the scare up before july 4th to keep the fears alive.

      --
      Silence is a state of mime.
    4. Re: Falling on deaf ears by ShanghaiBill · · Score: 4, Insightful

      Move the production where, Europe? Trade treaties will take care of that.

      Nonsense. There is no way that European countries (other than Britain, of course) are going to force their citizens to use devices that the American government can monitor. If they try that, Marine Le Pen will be the next president of France.

      Asia? Treaties again.

      China is far less likely to agree to American backdoors than Europe is. It is not going to happen.

  2. They tried it before. by GerbilSoft · · Score: 4, Informative

    The Clipper chip was designed by the NSA and had a government-sponsored backdoor. Unsurprisingly, it failed.

    1. Re:They tried it before. by gstoddart · · Score: 4, Interesting

      But now they have more secret "national security" laws which can be used to force it without people knowing or having the choice to reject it.

      So you'd never know if they're demanding it from companies.

      --
      Lost at C:>. Found at C.
  3. Experts? by hyperar · · Score: 5, Insightful

    Who doesn't know that backdoors are there for everyone who finds them and not just those who put it there?

    1. Re:Experts? by ancientt · · Score: 3, Interesting

      I can't believe I'm going to contribute to this side of the discussion. "Loathe" is the mildest word I can think of for how I feel about a government accessible decryption system, but I'm going to explain why it's not infeasible to maintain security and have government access, unlike so many posters seem to assume.

      Lets take cell phones as a starting example. The encryption of my phone isn't done with the password I put into the phone when I reboot it, the encryption is done with a randomly generated key which my password decrypts. There is no reason the same key that is actually decrypting the phone couldn't be encrypted with a phone manufacturer password. That government mandated password would encrypt the real decryption key just like my password does, but the government password wouldn't change when I change the password I'm using.

      Note the government password isn't the same for multiple phones, it's unique to each phone. The government password is a randomly generated complex string of numbers, letters and symbols and it's not stored on the phone.

      The government password for my phone is created at OS installation time and then the phone manufacturer encrypts it with the public key provided by the government. Those encrypted password media are sent to the companies selling the phones and those companies keep that media physically secured.

      The government must subpoena the key for a specific phone in order to decrypt its contents.

      The government password is now protected by:
      A) A PKI private key stored by a government agency
      B) Physical security at a non-governmental agency
      C) The somewhat abused but best available legal processes of our government

      Encrypted computer drives work the same. The assumption in both scenarios is that people fall into one of these groups:
      A) don't know it is there
      B) use the system their device came with
      C) don't understand how to change the system

      That covers 99.999% of people, probably even 99.99% of criminals. I may repartition my drive and install varying operating systems, and I may install a different OS on my phone, but normal people don't. Even drug dealers and terrorists are unlikely to do that when there are far easier ways to avoid incrimination. The fact is we could have such a "backdoor" already in play and we wouldn't necessarily know about it. I'm geekier than most by far, and I don't recompile the kernel on my boot partition to make sure it matches the one that is actually there. Granted, I do tend to wipe drives and start fresh, but if Redhat and Canonical are compromised, the NSA is good enough at their jobs, that I'll probably never notice. Do you know for sure the signature of your running kernel matches the one that you could compile for yourself?

      --
      B) Eliminate all the stupid users. This is frowned upon by society.
  4. Master key by comet63 · · Score: 5, Insightful

    Who would buy a lock from a company that made a master key that was good in all of their locks? Of course, they would promise to only release that key to authorized people. However, it is certain that eventually it will get into criminal hands. At that point, there is lots of money to be made from selling the key. Of course, lock companies could make lots of money off this proposal, but not the one who made the master key. The government might as well give up on a web based economy and go back to paper banking if they start giving out keys to all of the transactions.

    1. Re:Master key by Anonymous Coward · · Score: 3, Informative

      People still buy Master locks.

    2. Re:Master key by nine-times · · Score: 3, Insightful

      Who would buy a lock from a company that made a master key that was good in all of their locks?

      It's probably not the best example. I would hire a locksmith knowing full well that they could pick the lock that they're installing. That doesn't bother me. However, that's because I'm resigned to the idea that locks only keep out casual thieves, and that any lock I'm likely to put on my door can be picked. I'm not inclined to say the same sort of thing about my encryption.

    3. Re:Master key by BBCWatcher · · Score: 5, Interesting

      Everybody who buys suitcases. https://www.tsa.gov/traveler-i...

    4. Re:Master key by mlts · · Score: 4, Insightful

      Cryptography and physical security are often similar, but in other areas, they differ. Encryption algorithms are either extremely secure, or not worth the time in using them because every few years, CPU power doubles to attack them.

      Plus, with physical security, there is "good enough". I use an el cheapo Master warded lock on a chicken coop door... because it is nuisance protection. Same reason I use a six pin American lock on the gate. If it resists bumping or quick attack, good enough. Even with high security locks, their main function is mainly to work as a "seal", to show that if there is a break-in, there is physical evidence to show it is the case. A kicked in door, insurance will pay a claim. A picked lock? The claim almost certainly will be denied.

      Encryption isn't like that. Either it keeps everyone out, or it keeps nobody out.

    5. Re:Master key by Sique · · Score: 3, Informative
      I have one issue: Edward Snowden never sold any documents to the Russians/Chinese. Yes, he has been repeatedly accused of doing so, but so far, no document is known that was sold to them.

      Thus, claiming Edward Snowden sold documents to the Russians/Chinese amounts to a blatant lie.

      --
      .sig: Sique *sigh*