Slashdot Mirror
How Security Pros Look at Encryption Backdoors (helpnetsecurity.com)
An anonymous reader shares a report: The majority of IT security professionals believe encryption backdoors are ineffective and potentially dangerous, with 91 percent saying cybercriminals could take advantage of government-mandated encryption backdoors. 72 percent of the respondents do not believe encryption backdoors would make their nations safer from terrorists, according to a Venafi survey of 296 IT security pros, conducted at Black Hat USA 2017. Only 19 percent believe the technology industry is doing enough to protect the public from the dangers of encryption backdoors. 81 percent feel governments should not be able to force technology companies to give them access to encrypted user data. 86 percent believe consumers don't understand issues around encryption backdoors.
I can only conclude that almost 20% of security professionals surveyed are utterly incompetent.
86 percent believe consumers don't understand issues around encryption backdoors.
Maybe we should start explaining it in the same way that governments try to justify access.
Government claims to need backdoors to keep us safe from terrorists? Maybe we should ask "how is giving terrorists access to our financial information, medical information, power grids, etc, keeping us safe from said terrorists?" Keep it in the public eye that backdoors give terrorists access to our information just as easily as it gives "the good guys" access to it.
How to describe encryption backdoors to idiots and non technical people.
Ask them to pull out their house key. Now have them go make 10,000 copies of that key and label each key with their name address and door location. Have them include their normal working hours.
Now they are to pass out those keys to every police officer, fire department, medical service group in their area just in case the government needs to get in their house in an emergency.
Now ask them a question how likely would it be that 1 out of 10,000 would get lost or misplaced and end up in the wrong hands?
100% of the people I have explained it to that way suddenly change their minds. Though it is still a small sample size. Once a generic key has been created and passed around you might as well not have a key
i thought once I was found, but it was only a dream.
Using obscurity in encryption just doesn't work. It has to be assumed that everything about the encryption method is known. Which is typically why everything about encryption methods is known - the algorithms and source code are always available to anyone.
What is secret is the key that is used.
Introducing a backdoor would mean that the method of how this backdoor is implemented would be known to everyone - it has to be, or at least assumed to be. So the only way to implement a backdoor "securely" is by using a key. This means hardcoding a public key into all public/private key encryption schemes and using both it and the users' public keys to encrypt the data, which is typically just encrypting the key for the symmetric encryption method (AES, for example) being used.
I don't believe there would be a way to incorporate an extra key in a symmetric encryption system. Certainly not without seriously harming how the encryption works. And how would you hide the key? If the key is hard coded, everyone knows what it is, and can thus decrypt with it.
Then you run into the problem of what happens once these hard coded keys are known to everyone, 'cos you know it's only a matter of time before they are either leaked or found. A global key to unencrypt all internet traffic - ever hacker and cracker, no matter if they are white, grey, black, or any other colour hat, would be searching for that key. And it wouldn't take all that long to find, given enough computing power (read: botnet).
If a government does force this to happen, you know that they will be the first target for all of these people who find the global key(s).
The problem with governments suggesting backdoors in encryption is the same problem that generates a whole ton of bad decisions, grief, and politics towards the 1% - they live in a bubble.
Why the heck a whole ton of politicians keep suggesting stuff like that is because they are surrounded by staff that don't have a clue about security.
It's self evident for even people who read a bit on the subject: as soon as you put backdoors into encryption used by popular chat apps and whatnot, terrorists and criminals will just migrate to another platform that is out of the state's law reach and leave a whole ton of people who don't know better still using the platform, turning them into potential targets as their personal data starts to leak.
And this is only a single reason why backdoors would never work. Not even mentioning how in principle, encryption with backdoor is already not encryption.
They don't understand that good encryption has to be open and publicly audited, and that backdoor access would obviously leak, they don't understand how bad security practices are when handled by public sectors, how much data was already leaked by government mishandling, how the entire government would be far more vulnerable to foreign spies and terrorism in general should they weaken encryption, how banks would not be able to function without strong encryption, and a whole bunch of other stuff.
Here's a good thing about the suggestion though: it's a good sign of politicians you should never vote for. They are legislating and promoting ignorance for votes or fear mongering with little to no technical backing. They are risking to put the public in even more danger because they keep pressing for laws that they don't know the full effect of. They are wasting taxpayer time and money because of their own ignorance. Keep these people away from representative positions.