But I think that could lead to better encryption software with plausible deniability like Veracrypt has
But I think that could lead to better encryption software with plausible deniability like Veracrypt has
The average HNer won't be that affected but the general public will. Access to encryption will be greatly reduced and most people won't even care or notice.
So, back to steganography, then?
https://en.wikipedia.org/wiki/Key_disclosure_law
Generally it goes like this
1) you get a notice either from a judge or the police to provide unspecified assistance with an investigation (you are not told even 5 minutes in advance WHAT assistance, and there is a default gag order: if you inform a customer or ... that you handed over their info, you go to jail)
2) if you refuse to do something they charge you with a crime, not providing encryption keys is such a crime
3) look like EU "average" sentence is 2 to 5 years prison, plus 50k euros
One time pads are obviously encrypted, meaning if you see one you know they're a key to something, so if you refuse to decrypt what is encrypted with them (or can't, let's not pretend these people know or care about what is and isn't possible beyond obvious cases like whatsapp), and a police officer cares, you may very well have a choice: decode or face 2 years prison. JUST for not giving a police officer full access, for example, to your phone, nothing else.
Not obviously - you could have a 1GB blob of encrypted data, or a 1GB blob of random numbers, so there is plausible deniability.
You're right that they're vulnerable to a rubber hose attack, but it's not a slam dunk case in court.
Specifically on the issue of plausible deniability, though, you probably don't want just a 1 GB blob of random-looking data, you want a file system with various levels of "secret compartments" which open up depending on which key you use to open it.
The game theory is that this prevents the attack you describe (and after which Assange named this countermeasure) because you could never prove to your torturers that you have given them the last key, and thus you would have no reason to comply.
wrt a 'rubber hose attack' I'm really talking about general coercion, not actual torture. A court could jail you for contempt you until you produce the information it's demanding.
That works for encrypted drives and whatnot but it doesn't look especially applicable for any real-time communication.
"Ten camels drink from the water at $some oasis".
Meaning:
"Attack $city at 10 AM tomorrow"
Or
"Meet at $place at 10 tomorrow".
This has been documented extensively. All was perfectly legible by whoever can read conversations on facebook, but the meaning is lost.
PGP is, as before, a technical counterargument to this sort of oppression. Perhaps the powers that be need to be again reminded of its existence. After all, the proposal is to backdoor all encryption software. That is simply impossible.
It's a bit of a beast.