Slashdot Mirror
Crypto Guru David Chaum's Private Communications Network Comes With a Backdoor (softpedia.com)
An anonymous reader writes: David Chaum, father of many encryption protocols, has revealed a new anonymity network concept called PrivaTegrity. Chaum, on who's work the Onion protocol was based, created a new encryption protocol that works as fast as I2P and the Onion-Tor combo, but also has better encryption. The only downside, according to an interview, is that he built a backdoor into the darn thing, just to please governments. He says that he's not going to use the backdoor unless to unmask crime on the Dark Web. Here's the research paper (if you can understand anything of it).
If you can trace criminals you can trace dissidents and political opponents. Anonymity is difficult enough without it being broken by design.
Just telling everyone your software has a backdoor is the same spending all of your development time masturbating. No-one is going to use this crap.
Guy's an idiot genius!
I can pretty much, guarantee in writing, that if there's a _real_ backdoor (this could be all BS),
there will be individuals outside of the 9 "CHOSEN" who will have access to it. Further, if he's
dumb enough to deploy it, he's looking at a long time in a U.S. jail if the authorities want him to
decrypt some traffic - they're not going to believe the 9 people BS as much as the next guy!
CAP === 'appender' (I see /. is using non-words now)
Is he claiming he found a way to safely have backdoored communications?
Not sure what "safely backdoored" means. The system is spread out amongst many different countries in such a way that many different governments must agree to use the back door. If the USA, the Netherlands, and Russia can agree, for example, then it is probably criminal investigation and not spying going on. I reviewed many of the early drafts of this paper. It's pretty cool.
Or, another way to put it, a government needs to compromise only those 9 users to gain unlimited access to all encrypted communications through the system.
Is he claiming he found a way to safely have backdoored communications?
Nope. He is claiming he has implemented a method requiring multiple key servers to unanimously decide to work together to decrypt a message.
Specifically there are nine servers, all of which must be used together. If 8 of the 9 wish to decrypt something but 1 chooses not to assist, the message can not be decrypted.
He then suggests in his opinion that if those nine servers are spread around the world such that one is in control of by different democratic governments, it would follow that all nine of those governments must then agree the message in question needs to be decrypted.
So far as the axiom holds that "technology can do nothing except enforce a policy" - he is correct.
The question remains about those policies of course, not just at the time the nine servers are deployed and used but also for all time into the future.
Something he states no opinion on, which is also probably wise. My own cynicism has great doubts about that as well.
It's also worth pointing out that at least in the alpha stage of testing the protocol is currently in, this backdoor really is a "US backdoor", as for testing purposes all nine of those key servers are hosted within amazon cloud, so all under control of the same government.
During development testing this is fine, but the people testing the protocol should be absolutely aware of this fact. Test the other aspects of the protocol, assure the protocol as implemented matches exactly the theory. Find and fix bugs. But it is not to be used for trusted communications yet.
The next major hurdle of course is the very policies that need to be drafted and in place before the servers are codified to enforce them.
You know how governments and policies can be some times. It very well may be the case the policies never actually make it to a state anyone agrees is worth using, making the protocol a bit useless, even if not at the fault of the protocol itself.
What I'm taking away from this is that anything David ever has made or will make in the future should not be trusted.
With deep sorrow we announce the departure of another great security guy we once had. You will be missed.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
There's a term for that in data security circles. That's what we call NOT PRIVATE, for fuck's sake.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
In this case, a former /. member that hasn't bothered using their login for the last couple of years.