Hacker News Reader

Comment by kazinator | Hacker News Reader

What sort of lousy hard drive encryption reveals hash values of plaintext?

They have access to the OS drive, and found some logfile or metadata on there.

http://www2.ca3.uscourts.gov/opinarch/153537p.pdf

Despite Doe’s refusal, f orensic analysts discovered the password to decrypt the Mac Pro Computer , but could not de crypt the external hard drives. [...] The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash ” values to be child pornography. 3 The files, however, were not on the Mac Pro, but i nstead had been stored on the encrypted external hard drives. Accordingly, the files themselves could not be accessed.

> forensic analysts discovered the password to decrypt the Mac Pro Computer

A little concerning. Does the FBI have an undisclosed FileVault backdoor?

It's much more likely that he wrote it down somewhere.

From the PDF:

> Despite Doe’s refusal, forensic analysts discovered the password to decrypt the Mac Pro Computer, but could not decrypt the external hard drives.

So either the Mac Pro had a weak password or Doe had it written down somewhere. It's rather unlikely that the FBI has a zero-day for FileVault.

I don't think it's unlikely at all, however, it is unlikely they would disclose having it for such a meaningless case.

The value of this case to them isn't decrypting the data -- it's in setting a precedent on forced data decryption, which they can then use for other cases.

Someone quoted this in a post below: "Prosecutors said Rawls has a lot of "chutzpah" to even ask to get out of jail while he appeals the contempt-of-court order to the Supreme Court, which has never decided whether forcing somebody to decrypt hardware amounted to a Fifth Amendment violation.", proving the point.

Could just be a dictionary attack or similar password guess

What I've been able to piece together from the fragments of this case that have been reported by non-technical journalists is that he used some sort of P2P software like BitTorrent to download the files. This P2P software kept the checksums of every downloaded file on his unencrypted drive (basically it stored the torrent files somewhere). The FBI compared the checksums in those file to ones of known CP images and found some number of matches (how many has not been reported from what I've seen).

So it really looks like they've got plenty to convict this guy on the evidence they have, but are refusing to bring the case to trial until he unlocks his external hard drive for some reason.

That reason being, of course, that they can keep him in jail indefinitely until then, and then jail him some more.

It's one of two ways. It's either the hash algorithm hashes are strong enough to prevent manufactured hash collisions (not just accidental ones) and the gov could convict on the hashes alone, meaning the files aren't needed and the All Writs Act is not appropriate, so he's not in contempt. OR the hashes wouldn't stand the trial by themselves, and leaves a much weaker argument for the need to decrypt because you're less certain that it would contain the files you think it does.

I think the specifics in this case, Like the sister's testimony, go against the second possibly weakening their argument.

Things like OS search indices, recently used items databases or thumbnail caches can store hashes of files to identify whether they are up to date and referring to the correct file.

And if the state has that much, they may have a case already. Why not just try him already?

I had the same thought.

Reply on news.ycombinator.com