back to article WHY can't Silicon Valley create breakable non-breakable encryption, cry US politicians

At last week's RSA security conference, the halls were full of government speakers telling the tech community that it must do the impossible: invent a form of encryption that's strong, but also easy for law enforcement to crack. Ever since Apple and Google enabled full-device encryption by default on their mobile operating …

Page:

  1. The_Idiot

    There is...

    ... or may be, the usual possible sub-message here.

    When a US authority says something like this, that the crypto should have an easy way for legal authorities to open anything after 'due legal process', what they seem to mean more often than not is that there should be a an easy way for _US_ legal authorities to open the material after whatever the _US_ thinks is due legal process.

    They appear to see no issue with other country's legal process or authority, since those don;t matter to them.

    I'm also not sure which depresses me more - that they know what they're asking for is impossible, but are asking anyway so the Dear People see them 'doing something' - or that they really think it can be done. Sigh...

    1. Edwin

      Re: There is...

      Hmm... My European personal data housed on an American server by an American company in the USA encrypted by a system that only the American government can pop the lid on.

      What could possibly go wrong?

      (Hint: it's in Mr. Johnson's line about "the privacy rights and expectations of the American public")

      1. Yet Another Anonymous coward Silver badge

        Re: There is...

        > that only the American government can pop the lid on.

        Obviously this would be unworkable, unfair and wrong. Instead the data will also be accessible by your own government, and security forces, and police, and parish council and those of any other Eu country.

        The same keys will also have to be shared with all the agencies where the same software is sold.

        So say 200 countries * 10 layers of three latter agency + 10 different levels of government + 10 different law enforcement agencies + the milk marketing board= 10,000 government depts havign access to your data.

        1. Anonymous Coward
          Anonymous Coward

          Re: There is...

          If I lost my password I could quite possibly be one of the few people left on earth who can no longer access my data.

      2. asdf

        Re: There is...

        >the privacy rights and expectations of the American public"

        Which sadly get such a bad reputation due to the Boomers moving our culture to pure corporatism and the Millennials who think everyone wants to know what they ate for breakfast and what the shit they took after looked like.

        1. Edwin

          @asdf Re: There is...

          While your point about the Boomers and Millennials is spot on (and apparently universally true), my point was rather that the US guvmint acknowledges American citizen's right to privacy, but nobody else's. So while an American's personal information is protected by law in the US, my information is not.

          Yes, there's Safe Harbor, but I don't know that it's bulletproof and in any case only covers a small part of the rest of the world's population.

          1. asdf

            Re: @asdf There is...

            >US guvmint acknowledges American citizen's right to privacy,

            How except in rhetoric? The SCOTUS has whittled the fourth amendment down to a completely literal reading now where the only thing protected is actual paper letters in your own home (better own the property too) and even then they have added lots of loopholes.

          2. Looper
            Flame

            Re: there's Safe Harbor, but I don't know that it's bulletproof...

            It's not. It demostrably failed in the first year of "implementation" and every year subsequently. It is purely a marketing effort to attempt to hoodwink EU citizens that US companies could be trustworthy advocates and handlers of their data. They are not, can not, nor ever will be. The attitude regarding data privacy and security just isn't there in the US landscape. Any further attempts to lie and/or exaggerate how "well" US companies take care of your data will be hopefully met with appropriate derision by all stakeholders.

    2. hutcheson

      Re: There is...

      >When a US authority says something like this, that the crypto should have an easy way for legal authorities to open anything after 'due legal process', what they seem to mean more often than not is that there should be a an easy way for _US_ legal authorities to open the material after whatever the _US_ thinks is due legal process.

      >They appear to see no issue with other country's legal process or authority, since those don;t matter to them.

      >I'm also not sure which depresses me more - that they know what they're asking for is impossible, but are asking anyway so the Dear People see them 'doing something' - or that they really think it can be done. Sigh...

      You're being silly. Indisputably, once you generate math that works differently in the presence of legal paper, it is trivial to make that math work differently only in the presence of U.S. legal paper.

      I propose a different approach: here's a game to introduce at your next party. Call it the "Mike Rogers" Game." The object of the game is to express the maximum amount of obdurate ignorance while simultaneously making the broadest demands--in as few words as possible. Extra credit, of course, if your example is a quotation or precis of something you've actually heard someone say. Herewith a few samples:

      "I don't know anything about Maxwell's Laws, but I don't see why it's impossible to build a refrigerator that generates power instead of consuming it. That would solve all our oil-dependancy problems. I think it CAN be done and it SHOULD be done."

      "I failed second-grade arithmetic, but I don't see why 2 plus 2 always has to be 4. It would solve all our economic problems if accountants could just think outside the box and be more open to alternate ideas."

      "Statistics? I never heard of it. But the average of these numbers would be higher if you just had more numbers."

      The winner, of course, is acclaimed "Mike Rogers For A Day" and gets to peek in everyone else's underwear drawer.

      1. cjb

        Re: There is...

        ... as long as it's not password protected; oh wait ...

  2. Peter Simpson 1
    WTF?

    US politicians want Silicon Valley to create unbreakable encryption?

    But only if they hand the keys over to the government...you know, "for safekeeping".

    Seems like only a short time ago, they were whining that unbreakable encryption would create a playground for pedophiles and terrorists.

    Geez! Make up your minds, already.

    1. Robert Helpmann??
      Childcatcher

      Re: US politicians want Silicon Valley to create unbreakable encryption?

      This is what happens when someone in upper management watches The Expert and uses it as a template for how a project should be planned.

    2. Thorne

      Re: US politicians want Silicon Valley to create unbreakable encryption?

      "But only if they hand the keys over to the government...you know, "for safekeeping".

      Seems like only a short time ago, they were whining that unbreakable encryption would create a playground for pedophiles and terrorists.

      Geez! Make up your minds, already."

      They have. They need the keys to hunt for pedos and terrorists (Not movie pirates and whistleblowers I swear). This is why they should be trusted with the master key........

  3. John H Woods Silver badge

    The only thing that's harder than breakable unbreakable crypto ...

    ... honesty and intelligence in the political classes.

    What has the OK Bomb got to do with it? I mean really? Why wasn't the guy jeered openly when he mentioned it? If we carry on being polite to these people, we're going to be in trouble.

    1. Grikath

      Re: The only thing that's harder than breakable unbreakable crypto ...

      The problem is that a majority of politicians are quite intelligent, especially the ones that stay in the background.

      It's just that they apply that intelligence in a way that makes your average mafioso look honest and respectable.

  4. Anonymous Coward
    Anonymous Coward

    Who's wagging their tale then?

    Aren't the US Spooks decrying that devices like the iPhone encryption is impossible for them to break?

    So what do they want then?

    Encryption that they and only they can break?

    Pah!

    1. Anonymous Coward
      Anonymous Coward

      Re: Who's wagging their tale then?

      "So what do they want then? Encryption that they and only they can break?"

      No. Ignorance. It's obliviousness they've lost and are so desperately trying to (re)create. "Encryption that they and only they can break" is exactly what they believe they've already got in place. Which is exactly why they are saying exactly the oppisite.

      NSA: Never Say Anything.

  5. Anonymous Coward
    Anonymous Coward

    COINTELPRO

    Another wonderful counter-intelegence diatribe from El Reg. The US TLAs imply that they can't break the encryption which they spawned and which they have worked so hard to get us all using... and we're to believe that? Where've you been hiding Reg? Didn't you at least notice "the Snowden revelations"?

    The Register has been brought to you today by the letters M and I and by the number 6

    1. Anonymous Coward
      Anonymous Coward

      Re: COINTELPRO

      COINTELPRO historically was only used on brown people in the US. I guess the times are a changing.

      1. tom dial Silver badge

        Re: COINTELPRO

        I don't think Jane Fonda qualifies as "brown", let alone the Communist party, the great majority of whose members were equally white. J. Edgar Hoover and the numerous presidents for whom he worked, both Democratic and Republican, were largely equal opportunity snoopers.

        Not that the COINTELPRO program has anything to do with the topic at hand.

    2. Steve Todd
      FAIL

      Re: COINTELPRO

      AES was the result of an international competition and international scrutiny. The winning algorithm was created by Belgian cryptographers.

  6. ZSn

    Rubbish

    'if anyone can find a system that does both, Silicon Valley can'

    Rubbish - are there many decent cryptographers in silicon valley? It seems to be populated by hipsters, and caffeine fueled keyboard monkeys. They are the last people you would want to design a reliable cryptographic system. The best cryptographers, unfortunately, are in NSA and GCHQ, and nobody would trust what they would produce so this idea is dead in the water.

    1. Ken Hagan Gold badge

      Re: Rubbish

      "The best cryptographers, unfortunately, are in NSA and GCHQ, and nobody would trust what they would produce so this idea is dead in the water."

      The most depressing thing about this story is that the politicians don't seem to have noticed the immense stupidity of their request.

      Point 1: as Mr Schneier points out, maths works the same way for everyone.

      Point 2: as ZSn points out here, the best cryptographers *probably* work for the NSA and GCHQ and if *they* are the ones complaining then that probably means it can't be done by someone in Silicon Valley.

      Point 3: If it *can* be done in Silicon Valley, why in seven names of fsck is that person able to do something that the government agencies cannot?

      Even if their bizarre maths-of-the-day version of the universe were true, Silicon Valley *still* wouldn't be the place to look for a solution. How stupid do you have to be to be unable to see that?

      1. asdf

        Re: Rubbish

        >"The best cryptographers, unfortunately, are in NSA and GCHQ,

        No they may work with them and a few for them but Belgium seems for whatever reason to put out the best which is probably why the NSA specifically hacked the Belgium Telecom companies and put particular empathizes on hacking several cryptography professors computers.

        1. Anonymous Coward
          Anonymous Coward

          Re: Rubbish

          Don't know about the spooks, but the politicians would think Silicon Valley would be where it's at, because Silicon Valley is about business, which is what they're all in thrall to. It is the only kind of intelligence they respect: the ability to make money!

        2. Morzel
          Boffin

          Re: Rubbish

          That probably had more to do with the fact that BICS (the subsidiary of the telecom company that was hacked) provides quite a lot of roaming hub services to loads of interesting telecom operators (interesting to the NSA/GCHQ, that is).

          I would presume that Langley has other means to keep an eye on our (admittedly very good) cryptologists.

      2. tom dial Silver badge

        Re: Rubbish

        Key escrow systems are not new, and Schneier discussed them in some detail in "Applied Cryptography". Indeed, they were implemented (rather badly) in the Clipper and Capstone chips. Schneier also pointed out the various reasons that having such things, even if well implemented, was a bad idea. Many or most of those reasons are mentioned in the other comments. And then, as now, there was about zero inclination to use them except among the less thoughtful law enforcement officials.

        So it *can* be done, but it *should not* because it (still) is a very bad idea.

        1. P. Lee
          Big Brother

          Re: Rubbish

          >So it *can* be done, but it *should not* because it (still) is a very bad idea.

          Indeed. Or you could force the CA used by your target to sign a dodgy cert for your mitm attack. Or all the CA's for that matter.

          Which is fine as long as your target relies on large CA's, which they would be quite foolish to do. Of course, that would be commercial suicide for the CA, so the government would never suggest that they might already do that. Instead even intelligent and well-briefed personnel would probably loudly complain about unbreakable encryption so that.. oh wait...

          1. blondie101
            Big Brother

            Re: Rubbish

            What make you think that NSA (or other US TLA's) don't have copies of ALL private keys American CA's have signed? I assume they have (because I can imagine it and if I can....). To be safe in a x500 key infrastructure you have to self-sign!

            1. John Robson Silver badge

              Re: Rubbish

              Because a CSR doesn't contain the private key?

              It does contain the public key - but then they can know that anyway...

        2. tom dial Silver badge

          Re: Rubbish

          It is worth noting (credit Schneier for this as well) that various types of key escrow systems have a place as well. Reasonable use cases potentially include businesses where business related email and documents encrypted by individuals must be retrievable in the event of the employee's death, resignation, or retirement.

  7. Anonymous Coward
    Anonymous Coward

    Just clueless...

    That would be the politicians and those who believe authorities are out to get them - unless of course the skeptics are crims. Then the assumption would be true.

    1. Eddy Ito

      Re: Just clueless...

      and those who believe authorities are out to get them

      History teaches them otherwise. They are likely less clueless than well known cattle rancher Frank Oppenheimer and everyone else who had to report to the Loyalty Board or HUAC.

      Доверяй, но проверяй. Sorry Uncle Sam, without the transparency to verify your activities there can be no trust.

  8. asdf

    bah

    I thought they learned their lesson after the Clipper chip fiasco. I guess as good as most Americans in government (and much of the public) are at history (even fairly recent) its no surprise each new generation keeps doing the same dumb shit as the ones before it (Vietnam meets Iraq for example).

    1. Vendicar Decarian1

      The Republican half.

      50% of Americans are incapable of learning.

      They don't need to.

      Their Conservative political ideology tells them exactly how the world works.

      1. asdf

        Re: The Republican half.

        As much I enjoy ripping on especially the religious right and their ridiculous ideological and religious dogma some of the libertarian types are actually on the right side of this issue. Perhaps for the wrong reasons but the end result is correct.

      2. Anonymous Coward
        Stop

        Re: The Republican half.

        @Vendicar

        The problem is not just Republicans. Note that our current FBI and NSA leaders who are riffing on how easy "encryption for me, but not for thee" should be were appointed by a certain powerful Democrat who lives on Pennsylvania Avenue in DC.

      3. tom dial Silver badge

        Re: The Republican half.

        Conservatives, so called, are not alone in having an ideology that tells them how the world works. The Liberals have the same degree of knowledge, but with different content.

      4. Rick Giles
        FAIL

        Re: The Republican half.

        "50% of Americans are incapable of learning.

        They don't need to.

        Their Conservative political ideology tells them exactly how the world works."

        And the other half doesn't need to either.

        They believe the Government we take care of everything that it feels they might need to know.

        And if you aren't in the States, you are probably basing your opinion off of your state run media.

  9. Tubz Silver badge

    Never Happen

    What company or person in their right mind would use encryption that the US of Ass agencies has the keys to and then expect every other company and user in the world to trust that they or their lap dogs in other agencies like GCHQ wouldn't abuse it on their behalf to bypass home privacey laws ?

    1. Vendicar Decarian1

      Re: Never Happen

      Where is the encryption plugins for Email?

  10. Vendicar Decarian1

    Republican Moron.

    former Michigan congressman Mike Rogers – an ex-FBI agent who once headed the Senate Intelligence Committee – insisted that there has to be an encryption system that is both strong against everyone and, if a law enforcement official shows up with a court-obtained warrant, can be broken open to reveal the content.

    "I don't understand why we can't have both," he complained. "I think we can have both, and we should have it."

    Living in Republican La-La land otherwise known as Planet ConservaTard.

    1. asdf

      Re: Republican Moron.

      >Living in Republican La-La land otherwise known as Planet ConservaTard.

      Hmm you name call just like they do. Whenever I hear such things I often assume its some righty trolling the boogieman liberals.

      1. Destroy All Monsters Silver badge
        Holmes

        Re: Republican Moron.

        Especially as President Clingon presided the administration that came up with the harebrained scheme of escrow keys and the Clipper chip (I won't go into summary execution of US citizens by "law enforcement" which saw a righteous uptick back in the Reno/Freeh days...)

        1. asdf

          Re: Republican Moron.

          >summary execution of US citizens by "law enforcement"

          How 1990s, now such things are done by intelligence services. Less oversight that way. Bipartisanship is not dead when it comes to trampling the peon's rights (Patriot act, forgoing due process, ignoring fourth amendment, etc).

    2. Annihilator
      Meh

      Re: Republican Moron.

      "I don't understand why we can't have both ... I think we can have both, and we should have it."

      And I think this guy sums up the problem...

  11. Anonymous Coward
    Joke

    My Lord, I have a cunning plan...

    I have the perfect solution. Clearly having a second encryption key known only to the authorities will fail - because that just downgrades the whole system to one of security through obscurity. No, instead I have a much better proposal, which I call CITM encryption or Court In The Middle encryption.

    In order to send an encrypted message you must first send it to a special Court appointed website, which will encrypt it for you. You then download the encrypted version and send it by standard email as now. Recipients repeat the process in order to receive a decrypted version.

    The beauty of this scheme is that if the 3 letter agencies want to read someone's email, they need only apply to the Court which simply _stops encrypting that person's email_. The agency can then easily read the plain text with no need for decryption at all! Simples!

    Now, how do I get in touch with this Mike Rogers?

    1. Grikath

      Re: My Lord, I have a cunning plan...

      I don't know.... there's no mention of turnips at all!!

      1. Anonymous Coward
        Anonymous Coward

        Re: My Lord, I have a cunning plan...

        > I don't know.... there's no mention of turnips at all!!

        The default encryption key is 'turnipshapedlikeathingy'.

      2. Martin 47

        Re: My Lord, I have a cunning plan...

        Have an upvote for the Blackadder reference

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like