Hacker News Reader

Comment by austenallred | Hacker News Reader

Can someone explain to me how a proposed government backdoor into encryption would work? Is every creator of encryption software supposed to build in a master key and hand that over to the FBI?

I ask this in all seriousness, as I cannot fathom how such a system would be implemented, even disregarding the Constitution and the willingness of those creating the software.

View on HN

Contrary to many opinions here, this is not a new problem. For many years encryption products included "work reduction" schemes. Not backdoors per se, but schemes that allowed those with the insider knowledge to bruteforce the encryption in a reasonable time. Those without the knowledge (the public) still faced strong encryption. It worked back in the 90s. With today's computing power it is likely no longer practical.

Google "export grade encryption" and "lotus notes"

https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

Dark dark days for privacy, and it came back to bite us as the FREAK vulnerability, but those in charge today are old enough to remember such tricks. That's why generals still talk of cooperation to create reasonable backdoors, they confuse true backdoors with the old work reduction schemes.

See also TSA Master keys for a physical implementation and how well that works (or not). [1]

[1] https://www.schneier.com/blog/archives/2015/09/tsa_master_ke...

Steven Levy wrote an excellent book about the first big battle over encryption standards in the 90s, "Crypto". One of the more heavily pushed "solutions" was the Clipper Chip, which was essentially key escrow.

"Is every creator of encryption software supposed to build in a master key and hand that over to the FBI?"

Including, presumably, not only programmers who're not under the jurisdiction of the FBI, but also programmers for whom the FBI is genuinely "their and their nation's adversary"?

Reminds me of a recent tweet: Homeland Security's new "House Un-American Mathematics Committee": https://twitter.com/puellavulnerata/status/67290345222221824

That link 404's

Ahhh, sorry. Here: https://twitter.com/puellavulnerata/status/67290345222221824...

It won't work. That's about it. I.e. once there is a backdoor, security is compromised and it can be used both by law enforcement and malicious attacker.

https://en.wikipedia.org/wiki/Key_escrow https://en.wikipedia.org/wiki/Secret_sharing

It's a terrible idea. The only proposed methods with theoretically possible security would suffer insurmountable side channel issues.

Edit: more https://dspace.mit.edu/bitstream/handle/1721.1/97690/MIT-CSA...

That makes sense (technologically). Still a terrible idea but I understand how it would be done now, thanks.

Like most insane directives I'd imagine this one isn't intended for the masses. Only for the ones you want to compel. This isn't as technical an issue as we'd want to believe.

They want to be able to light a fire under your ass. Once they light that fire, the technical issues are moot.

I guess that's the overall idea.

Also, the US will probably forbid anybody from outside their jurisdiction from creating encryption software, otherwise it won't work. \s

And of course that is balancing on the assumption that only the US has people capable of building such software.

Reply on news.ycombinator.com