Reminds me of the time someone tried to legislate pi=3. There's absolutely no way to give police a back door into encryption without giving criminals the same back door.
This feels disingenuous to me. It would be fairly trivial, for example, to store a copy of all keys, encrypted with the government’s public key. Of course, there’s a million eats to go wrong, but that’s different from “mathematically impossible.”
https://www.washingtonpost.com/news/powerpost/paloma/the-cyb...
https://www.schneier.com/blog/archives/2018/05/ray_ozzies_en...
https://www.justsecurity.org/53316/criminalize-security-crim...
As is pointed out in the Schneier article, the problems with a key escrow scheme are on the law enforcement side of things. They could lose access to their keys, especially if a lot of different agencies have keys.
Those are difficulties that can in theory be overcome, although it may not be practical to do so. That's a far cry from a pi = 3 issue.
This is approaching a pi = 3 level falsehood because of the “in no way compromises” clause. There are many schemes that are outright illegal (in my not a lawyer interpretation of this law), and it nakedly makes the other schemes harder with state actors as additional points of failure.
Appealing to Schneier on the topic of encryption is not an irrelevant appeal.
I’m not a cryptographer but I assume there are other schemes that are at least weakened by the requirement of a third party holding a key, much like the TSA master lock program was broken by statistical analysis of locks that were mastered this way.
But the mathematical impossibility if this aside, there is a very real practical impossibility if trusting an organization as large as the US government to keep such a database secure. There are better ways to help law enforcement than blowing such a large gaping hole in the web.
Most secure N party communication systems can be made to be secure N+1 party communication systems. If that +1 is the police, then arguably you have in fact given police a back door without giving criminals the same back door.
Criminals who want in would have to do so the same way they would before the back door--compromise one of the parties to the communication--except now there are N+1 parties to try and compromise instead of N so the attack surface is larger. How much this lowers security depends largely on the competence of the +1 party.
The popular model of a back door seems to be some wide open spying interface protected only by running on an undocumented port or something like that, and that all the bad guys have to do is get a copy of one client, reverse engineer it to find the access info, and then they are in.
For some reason, people tend to overlook that a back door is really just another communication channel, and the mechanisms modern cryptography provides for securing communication channels apply to back doors as much as they do to any other channel.
Nevermind that increasing the parties being attacked almost always makes the job easier not harder. See the TSA master key debacle for an example of how adding a third party master weakened the security and allowed statistical analysis to break the lock.
As long as one corrupt cop exists on the access pool the premise doesn't hold up.