Hacker News Reader

Comment by draugadrotten | Hacker News Reader

Doesn't Schneier miss the mark here. Even if the US, Australia or all of the Five Eyes nations stop spying, that does not ensure encryption is unbroken or safe from spying eyes. If it is possible to break encryption, it will be broken by someone. It better be by us...

As far as designing in weaknesses and/or golded keys. Well, it does not add to security, but assuming that the other nation states are already able to break encryption and read what they want, it does not weaken it either for national security reasons. What it does provide however are easy means to stop terrorists, pedos and drug dealers from conducting business. That power in the right hands is good for society, just like having people with lethal weapons in law enforcement is good for society.

Remains the risk that some bad guys could get their hands on the golden keys. Yes, design to handle that?

What else?

View on HN

> If it is possible to break encryption, it will be broken by someone. It better be by us...

The option isn't encryption broken by them or broken by us. It's secure encryption or encryption that can be broken by everybody with sufficient resources.

> Remains the risk that some bad guys could get their hands on the golden keys. Yes, design to handle that?

Yes, because secure systems are so secure that we should be trusting them to base all of the world's encryption on. It takes a single bug or intrusion to undermine everything. There's no way to design for a key that needs to be usable/accessible for when you need to access encrypted anything, while keeping it secure from bad actors.

That's even before considering how the US government and US institutions have, over the course of the past decades, pissed away any and all good will and trust that the public may have had in them. Why would anybody want to give the FBI or NSA free access to all of their data? After seeing enough stories of employees looking at naked pictures, stalking ex-girlfriends, dragnet surveillance or other gross abuses of power, there's no way these people can be trusted.

You are correct in exactly the same way that, if one assumes that the Earth is flat then it is impossible to fly around it in an airplane.

There exist cryptographic security measures that have flaws and can be broken by nation states. But there are also plenty of encryption techniques that will easily resist the efforts of even the most effective nation states (at least for the present day). The question is not whether such codes exist but whether we will pass laws preventing any law-abiding person or company from using them.

If you were right and the NSA could break these codes then they wouldn't be advocating for back doors, they would be encouraging everyone to encrypt their communications (to protect against everyone ELSE), then using their abilities to stop terrorists, pedis and drug dealers.

> Remains the risk that some bad guys could get their hands on the golden keys. Yes, design to handle that?

You can't. That's pretty simple and solid.

If you have design a master key, then it's the master key. Once it's out, it's out.

To play devils advocate: what about the keys with which Apple or Microsoft signs their updates? It's analogous to a master key, yet they didn't leak so far although the stakes are high.

Apple/Microsoft have a master key to one product which is held by one private company. What you're talking about is a master key to all communications accessible by every government agency of every country provided (maybe) that they can demonstrate "just cause" (or some other nebulous concept). Surely you can see the difference in magnitude?

In theory, the key could stay at the company and the communications is handed over upon lawful request.

To be clear, I am not supporting this. But this will be an argument being made by the other side thus a good reply should be prepared. NOTPetya already demonstrated that malware can come with software updates. But up to now there is no hard evidence that keys of big players have been leaked.

And even for professionals it's hard to keep up. I am using Signal. From time-to-time I am reminded by Signal (on Android) that I need to update taking me even to an update screen. How would I know that it is genuine? No other app I have does this.

> In theory, the key could stay at the company and the communications is handed over upon lawful request.

What is a "lawful request"? Does that include legitimate court orders originating from China, Russia, Syria, Sudan, etc?

That's why this will never fly. It's a horribly stupid idea.

It's either a lawful request from any country or none. Should corporations get to decide what a lawful request is? That's a horrible idea either.

FWIW, I am appalled by this constant call to weaken encryption. This is not worthy of any country who deems themselves under the "rule of law". It's even more appalling that they do the dirty work for the countries you listed...

> It's either a lawful request from any country or none.

My preference would be to group countries into categories that respect users and their privacy, and those who don't. And then don't pursue selling into countries that don't respect privacy. And no one gets "gold key" or "backdoor access". It is only a legal front door to the data the provider possesses in plaintext. Specifically, data residing SOLELY on the device would NEVER be in said provider's possession in plaintext form, if the user desired that.

But that will never happen. Because, growth markets, amirite? (Sad face)

> Should corporations get to decide what a lawful request is? That's a horrible idea either.

Agreed. Corporations don't get to 2nd-level guess the law (ignoring lobbing in this example). They either get to choose to operate within laws of the territories they do business in, or they don't do business in a said territory. This is my EXACT complaint against Uber, AirBNB, etc.

> FWIW, I am appalled by this constant call to weaken encryption. This is not worthy of any country who deems themselves under the "rule of law". It's even more appalling that they do the dirty work for the countries you listed...

In total agreement. Furthermore it is what is view as extremely easy. Of course the NSA/CSS/CIA/ABC/DEF whatever will always target and crack-open the endpoints. To do a double-duty and attack the crypto itself is just fucking annoying to me due to the collateral damage said efforts bring. They already own the endpoints. Just focus on that. Don't attack the math operations.

Just as importantly, they use that key very infrequently which allows for a great deal more ceremony around when it's taken out and a lot more restriction around who has access to it. I'd expect that the key is only kept on air-gapped systems, for instance.

Microsoft have had their golden keys leak before. [0]

[0] https://www.theregister.co.uk/2016/08/10/microsoft_secure_bo...

We aren't aware if they leaked already or not. We aren't even aware if they were used in malicious way either - state actor could make both of those companies stay silent about that.

That could easily be leaked by a single person, like Edward Snowden. People are not the perfect way to store secrets.

> As far as designing in weaknesses and/or golded keys. Well, it does not add to security, but assuming that the other nation states are already able to break encryption and read what they want, it does not weaken it either for national security reasons. Except that it's only your country whose encryption gets broken. You're basically giving your enemies free reign to spy on you and your country if you force a golden key system into use. Do you think China will use your custom crypto system? Or any other country for that matter? You end up in a situation where you _lose_ power because you want to spy on journalists, human rights activists and undesirable parts of the population.

> What it does provide however are easy means to stop terrorists, pedos and drug dealers from conducting business.

I can't remember the last time a law passed to hunt down the pedos/terrorists/drug dealers hasn't been used to surpress or hurt some part of the population. Remember when drug dealers just used SMS? When pedos exchanged magazines and floppies? When terrorists just called each other? And how the government, with all its wiretapping power, couldn't stop any of them? Encryption is a nice bonus for these people, but a lack of it is not stopping anyone. Tangentially, if a country would focus on properly treating addiction instead of making boogeymen out of those darn drug dealers we might actually get anywhere as a species.

> Remains the risk that some bad guys could get their hands on the golden keys. Yes, design to handle that?

How would that even work in a crypto system? If you have the key, you can decrypt. That's the basis of cryptography. Wishing away the glaringly obvious problem with the proposed system by telling people to "design it not to break like that" doesn't work.

That assumption is the weakness in your argument. If you design in a systemic back door, it becomes a known fact that a hostile actor could find a way into your system, because you have created one for them. Not only that, but in the case of a golden key, if it leaks then anyone can get in.

Of course there is no guarantee that any encryption scheme is 100% unbreakable. Such is the nature of mathematics and research. But there is a fundamental difference between needing to discover a systemic weakness in an encryption scheme, say an efficient solution to the discrete logarithm problem or a side channel attack on a given implementation, and merely needing to know some master password that will work even if the mathematics of the encryption method and its practical implementation are sound.

> Remains the risk that some bad guys could get their hands on the golden keys. Yes, design to handle that?

after all, it worked so well for the TSA security key: https://techcrunch.com/2016/07/27/security-experts-have-clon...

Reply on news.ycombinator.com