Hacker News Reader

Comment by Topgamer7 | Hacker News Reader

I challenge him to describe what an encryption backdoor actually is. Its like putting a hidden switch behind a brick in a wall. The brick looks the same, but if you take the time to knock on every brick, you'll eventually find the button. Every moderately powerful nations will have someone out there knocking on the bricks.

View on HN

It takes a prohibitively long time to knock on 2^256 bricks. The real risks aren't from the crypto; they're from the humans who have access to the back door. Can they be trusted? Can they be compromised?

That's not to mention the business damage this would cause. The US is trying to block Huawei products due to back doors. Other countries will block US products if the US government starts requiring back doors.

> It takes a prohibitively long time to knock on 2^256 bricks

This assumes you have to knock on 2^256 bricks and not just wiggle the mortar free in one spot. WEP wifi encryption is an example of an implementation failure vs. theoretical time to brute force the encryption.

You're right, but the answer to encryption backdoors can't be "we don't think you'll make good enough backdoors". Even if the backdoor can't be opened by anything other than acquiring the government key, it's still not acceptable.

Yup, in fact that's my point. No matter how good the encryption or implementation is, there will always be a weak link and someone that finds a way in. For some people, its a fun challenge and bragging rights. For others, it's profit.

GPUs have been shown to be very good at complex math problems. A nation state with unlimited money could find a weakness built into crypto in a matter of days at most. A bored hacker would probably find it in a few hours.

You've been watching too much TV. Actual encryption primitives are often used with keys that would require a computer the size of the solarsystem to brute force. Bored hackers and nation states do not have such computers, no matter how well they are funded.

I'm not talking about brute forcing good encryption, I'm solely talking about nation states ability to find the back door entry. I may have confused the issue taking about GPUs.

"Can they be trusted? Can they be compromised?"

No, and yes.

This is not cynicism speaking, this is realism. Basic principle of security is to make the cost of breaking the security greater than the value of what is being protected. In this case, the "backdoor" keys will be protecting many, many billions and probably trillions of dollars of worth of information. At that scale, a foreign (or domestic...) intelligence agency finding the n of m people necessary to get the key and making it clear that if they love their family, their personal well-being, or indeed, anything in the world at all, they will hand over the key information is completely on the table. It isn't even just that there isn't anyone who can't be trusted with the keys, there isn't anyone who can stand up to the pressure that can be brought to bear on them. Put the keys in the hands of the most honest person on Earth who literally can not be coerced into giving it up, and it just means their family is the walking dead until the agency finally gives up and murders our magically honest person, and the key falls to the next in line and they try again.

(Or, in other words, if this backdoor is created, and the people in charge of the backdoor and all their families are still alive in a year, yes, I would consider that proof positive it's already been compromised. The stakes are that high.)

These backdoors would literally be massively more valuable than the nuclear codes, which still require various physical access and other things to be penetrated to use them, whereas these will be immediately valuable simply upon possession. Even if we entirely ignore the question of internal trustworthiness of the holding organization, which we shouldn't, but even if we do, no conceivable organization consisting of conceivable human beings can possibly secure this information. It's just impossible.

(Also: Note the complete lack of reference to any technical considerations. It doesn't matter what the encryption algorithm is, or whether it's secure on its own terms, or whether the tech companies are being unpatriotic, or anything else. There is simply no way to secure any information this valuable.)

That's a nice analogy, but it's still an analogy. It's easy for someone to come along and modify the analogy to fit their purpose e.g. "we'll have someone watch the wall of bricks so no one can knock on them!"

We simply can't let people legislate on issues they fundamentally don't understand. And understanding a backdoor is actually not that difficult - a smart, motivated person could literally learn the theory of this with some practical examples in a few hours of study.

Probably something like this: https://blog.cryptographyengineering.com/2018/04/26/a-few-th...

I believe this is how Australia is going to have their backdoors.

A backdoor isn't just an entry point. Its a m architecture. A vulnerability like the the exhaust vent on the Death Star plus a detonator custom built to blow the whole thing up, and then hoping that no one misused this thing that shouldn't even exist.

Ditto larger and more organized criminal organizations.

I'm going to add that toddlers [teenagers / lone wolves] will also try knocking on bricks if they see their parents [governments] doing so successfully.

Reply on news.ycombinator.com