Hacker News Reader

Comment by monster_truck | Hacker News Reader

There literally are not. Anyone competent enough to be an expert witness will be able to plainly explain to everyone else how statistical analysis obviously delinates the difference between truly random noise and an encrypted volume.

View on HN

If there's a difference visible, that's a weakness in the encryption algorithm.

Encrypted data should be statistically indistinct from random noise.

It's an information theory thing. Everything in the ciphertext should be sitting at maximum entropy.

Try it for yourself brother, there is a plainly obvious difference between the random noise of writing garbage compared to a properly encrypted binary.

There are even statistically measurable differences in the garbage written across versions of a tool or OS, which, unlike the invented scenario above, has been successfully used to place a time window on when exactly someone destroyed evidence.

I'm a security researcher.

"Garbage" isn't the same thing as random noise.

I have looked at the entropy graphs of encrypted data commonly. It's one of the first things I look at when looking at a new firmware image I haven't seen before.

Loll, you have a lot of faith in the legal system that I do not. Expert witnesses are commonly full of shit.

I didn't say all expert witnesses are good nor did I claim they are all used in good faith.

Merely that, unlike in the invented scenario above, statistical differences in the random garbage that gets written to a disk across different tool or OS versions has been successfully used to place a time window on when exactly someone destroyed evidence.

I heard one argue that "zooming" on an image by adding pixels with an algorithm is normal, and he's had such "evidence" used in court before. I was a little horrified as someone who has worked on digital forensic software at a former employer. Adding pixels to an image is not evidence, you're fabricating something out of thin air, especially if its drastically smaller, its even more likely to be BS.

Are you saying any photos I take with phone that had digital zoom is automatically I admissible? Or if not, isn't that consistent with what they said?

but... how _else_ would you Enhance the image?

You know that defence can bring in an expert witness too right?

Even if that is true, I have better things to do with my time and money than pay a expert witness to explain: see, I wasn't breaking the law, I just wanted the cops to think I did. That just seems like a really bad idea.

> the difference between truly random noise and an encrypted volume

A LUKS volume with a detached header is indistinguishable from random data.

Have you actually compared the random data that various tools write to a disk to encrypted files? Load up binwalk and give it a rip, you will be surprised by how distinct the entropy graph is between the two

What you propose ("the random data that various tools write to disk") is not _random data_.

Compare the entropy graph of /dev/random against a LUKS volume with a decrypted header, and you will see no difference.

s/decrypted/detached/

Reply on news.ycombinator.com