From your link:

"And so the public policy debate around encryption has been framed as a binary choice between two absolutist positions: either we allow law enforcement no access at all to encrypted data, or we must effectively give them complete, unrestricted access to all our communications"

Most people support giving some level of data access to law enforcement, but the problem is that there's no way to restrict it to just law enforcement. As soon as we give one person or group access to the data, then we've effectively given everyone access to that data.

Perhaps there was more in the presentation, but this is the only idea I see in the slides:

"Idea: Make brute force key recovery possible but very expensive"

Again, that assumes governments that actually follow rule of law, but any criminal is going to use stolen credit cards to rent for servers in the cloud (or a hacked bot farm) and crack that encryption at no cost to themselves.

> Perhaps there was more in the presentation

Yeah sorry, the TED-like format at Enigma makes the slides by themselves fairly useless.

OTOH, it also lends itself somewhat easily to posting the talk on Twitter, with text attached to each slide. So I did that. https://twitter.com/hackermath/status/956617943768481792

Your talk was excellent, kudos to you for being willing to present a controversial idea to an audience that is instinctively hostile to any intentional weakening of crypto. It was certainly a hot topic at lunch.

My primary concern and others’ was that strong crypto is already out there and can’t ever be taken away. I understand that you’re choosing to hand-wave over this for the sake of bringing a novel idea to the table, but I’d say it’s a fundamental flaw that can only be addressed by not only outlawing strong crypto in every country, but also finding a way to prevent criminals from implementing and using algorithms that have been known for a while now. That seems, to say the least, quite hard.

Thanks for the kind words.

We're trying to get a productive discussion started, so hopefully we can reduce the risk of ever getting stuck with something truly horrible like mandated backdoors or key escrow.

Re: strong crypto can't be taken away - That's very true. I guess it depends on what threat model Wray is hoping to go after.

At least until a few years ago, the terrorists weren't even using encryption -- they were posting publicly about their upcoming attacks on Facebook! There was this awkward period of a couple of years where, after every attack, the authorities would claim there was encryption preventing them from stopping the attack. Then some days later, we came to find out that the attacker was already known to them and had been communicating in the clear!

So I think if Signal, WhatsApp, Telegram, ..., all moved to some very-very-expensive-but-breakable model, that would cover most of the guys doing knife and gun attacks, truck bombs, etc. in the real world.

> So I think if Signal, WhatsApp, Telegram, ..., all moved to some very-very-expensive-but-breakable model, that would cover most of the guys doing knife and gun attacks, truck bombs, etc. in the real world.

Doubtful. There are enough privacy obsessed computer scientists that oprn source, secure alternatives would soon crop up. Then you're criminalizing perfectly legal behaviour (programming) just because it indirectly might help some criminals.

Who said anything about criminalizing it?

Most people are going to use whatever is easiest and/or most popular. The same forces that make it hard to get all your friends onto Signal would also make it hard for violent people to use something new.

https://en.wikipedia.org/wiki/Nudge_%28book%29

(Not that I think the Signal team would ever go for any kind of weakened security, unless it was an absolutely final last resort.)

> Most people are going to use whatever is easiest and/or most popular

Because if these measures were taken, it would become common knowledge, and criminals would just switch to what's safer for their coordination. It may cast suspicion on anyone using these services, but that's not really enough.

> Do they really want only a limited ability to access encrypted data? Again, I don't know.

These arguments were all hashed out in the 1990's CALEA discussions. Assertions were made to "Trust Us", only limited use of the automated phone tapping requirements are envisioned.

A few years later the CALEA technical requirements for tapping capacity were published.

If I recall correctly (these are old bits), the capacity for the number of concurrent taps the FBI required for Manhattan was approximately the number of simultaneous off-hook phone lines expected for that size population. In other words, "capture it all".

That's how "limited use" tends to go.

Yeah it's never going to work if the approach is "trust us" or any kind of "limited use" that requires restraint from the humans supposedly being limited.

We need strong technical limitations, on par with the strength of the crypto we use today.

As with most arguments of this nature it sounds OK-ish until it gets concrete. There is no way to scale the cost of cracking encryption to future computing capability. It's like saying "A terabyte! Consumers will never be able to store a terabyte!"

Widespread cracking of 10 year old encryption would be a security disaster, which is why cryptographers think in terms of astronomical numbers, not earthly scales.

Lastly, why, given their track record, are you willing to take US law enforcement at their word? Do they deserve that consideration? Like any potentially deadly tool, law enforcement has to be approached with caution.

> But suppose we could construct a truly limited mechanism that would give them the ability to recover only a small amount of encrypted data.

Do you believe that this is actually possible? How? I ask because this being doable is crux of your argument, and every proposal I have seen falls laughably short.

If you had asked me if single-server private information retrieval was possible, I'd have said no until I read papers on single-server PIR.

If you had asked me if oblivious RAM were possible, I'd have said no until I read papers on ORAM.

I think we could do a lot more than we are now.

Original poster (emphasis mine):

> I have never met anyone who understands what cryptography is, and supports the FBI.

Your reply:

> I think (some of) what the FBI is asking for lately is actually not that unreasonable -- assuming we could do it right. ... suppose we could construct a truly limited mechanism that would give them the ability to recover only a small amount of encrypted data.

One precludes the other...

> One precludes the other...

That's quite insulting.

Personally, I'm getting a bit tired of hearing "lol nerd harder! It's impossible!" from people who can't even spell IND-CPA. (Not saying that you are one of those. Just that there are a lot of them around.)

If it's really impossible, then somebody needs to show up with a proof of impossibility.

If it's a matter of a backdoor/special key the FBI must keep secret, it will leak, period. Then what?

If it's a matter of having the computing resources to crack a key, then people's computers are too easily compromised to act as bots to solve any such problem. Our computing infrastructure is simply too vulnerable. To avoid this scenario, you'd have to secure every operating system in the world in a way that they could not be compromised, even in principle. That's as close to a proof as should be needed, unless there's a compelling counterargument to suspect some assumption is false. I have yet to hear such an argument.

It will leak, period? What's the Dual EC private key?

1. "I'm not aware of it having happened, therefore it has not and will not happen". I won't even bother listing all the fallacies in that position.

2. Dual EC isn't protecting anything of value, and hasn't in about 15 years. If your reply is meant to be pedantic about my phrasing, notice that the context is about encryption that is actually in use.

It's not protecting anything of value, you mean, besides every VPN session generated by the most important vendor of hardware VPNs in the industry prior to 2016?

i don't know about you but i'm willing to give the computer science professor who gave the presentation at a security conference the benefit of the doubt about understanding encryption

He specifically says "assuming we could do it right."

We can't.

Moreover he has no response to the question of how to scale the idea of "expensive to break" into even the near future. And then he is aggrieved and asks for "proof of impossibility" never mind the more fundamental problem with that ask, it's not something his suggestion even approaches needing. It's trivially insecure. He has done nothing to suggest that the assumption that "we could do it right" holds water. And who is "we?" Even "we" is a tendentious notion.

> how to scale the idea of "expensive to break" into even the near future

This part isn't actually that hard. Suppose your computation costs $1M now, and Moore's Law continues doubling computation per watt every 18 months for the foreseeable future.

Then in 15 years, the same computation will cost 1/1024 as much as it does today. So you're paying about $1000 per message for 15-year-old data.

In 30 years, you'll be paying about $1 per message for 30-year-old data.

Is that good enough? It totally depends. For most messages, it's almost certainly fine, because the value of the message decays over time. For other messages that hold their value, you need to set the initial cost higher. The formula above shows how you could that to achieve a certain cost at a time a certain number of years in the future.

As to the rest of your comment - this is not how we do science (or engineering). If we cried and gave up every time we encountered a hard problem, we'd still be living in caves, hitting each other with rocks.

You can't predict the future of computation. Look at the cost curve of Bitcoin mining. You may say you ("you" not "we") will learn from that. You are suggesting it's ok to trust your assessment of encryption strength. Show me a multi-decades track record of your predictions holding up when cryptographers designing secure systems don't have such a track record. Your idea amounts to Russian roulette where the gun gets more bullets over time.

> You can't predict the future of computation.

Yes and no. Can we predict it exactly? Of course not. But we can estimate the rough order of magnitude with high confidence. It's not hard to find charts showing transistor density over time, and Moore's Law holds up pretty well since the 1970s.

If anything, the two big changes on the horizon are (1) quantum computers and (2) the end of Moore's Law. (1) is really hard to predict, and it will make all our current techniques vulnerable anyway. When (2) finally happens, it will only make future predictions easier, not harder.

> Look at the cost curve of Bitcoin mining.

Sure. Mining was expensive, so people put in a lot of work to make it more efficient. Now it's more efficient, but the easy optimizations are gone. ASIC miners are something like 20000x more efficient than recent CPUs. Do you really think there's another 10000x hiding in there? 1000x? 100x?

For comparison, AsicBoost was (is?) regarded this huge big deal, and it only yields about 37% improvement in mining efficiency.

> Show me a multi-decades track record ... when cryptographers designing secure systems don't have such a track record.

I know this is not quite what you asked for, but you don't have to look very far to find an encryption primitive that has "stood the test of time" cryptanalytically. It's called DES, and it's older than most people posting here. The only reason we don't use it now is because it uses tiny little keys that can be efficiently brute-forced.

https://en.wikipedia.org/wiki/Data_Encryption_Standard

Its replacement, AES, is now 20 years old and is holding up comparably well.

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

As you mentioned, that is not what I asked, and your answer is not relevant to the inherent weakness of treading on the edge of weakness in encryption when even those specifying secure key length guidelines must rethink what is secure.

Math is hard. Let's go shopping!

What do you think corporations do to their corporate laptop disk encryption? Have only the employee be able to access it?

We previously allowed them access to private records with a system of due process involving judges granting warrants on a case by case basis. Instead of following the intent of the law, or even the letter of the law, they recorded everything using either robo-signed warrants or retroactive warrants when they actually needed to make legal use of the information. It was a framework of reasonable judicial oversight and what we got was totalitarian surveillance.

The problem is that law enforcement, spooks, and the judicial system are all on the same side and see themselves that way. You can want a system of due process, but you won't get it.

Fool me once...

Exceptional circumstances are a problem no matter what. Say they were serious about that.

Why should the police only be able to search a phone for a terrorism investigation? If I or someone who I cared about was murdered, raped, burgled, etc, I would resent being a second class victim, unable to get justice.

Your approach is interesting. Some things on my phone are my personal papers and effects. Other things are just metadata or other incidental information. There's room for grey.

Who decides what's "metadata". Even with TLS you can still workout what site someone's visiting because the hostname is exposed by SNI (and if it's not SNI, then it's a single IP per hostname so you can just check it).

The hostname tells you when someone's visiting a rape counselling forum or a STI website or a whistleblowing site. It tells you what their political perspective is, their media landscape.

That's data the FBI can already get.

Who would be allowed? Every FBI agent? Just the chief? Even if you could restrict it - thousands of government related figures in the FBI, NSA, DHS, TSA and elsewhere would want the key.

That entirely misses the point. The whole idea behind the existence of a "key" means that the key can either be mishandled, stolen, or independently discovered, rendering cryptography inherently insecure.

Well, the one idea we have now is to limit it to whoever can authorize spending thousands or millions of dollars in electricity to solve a computational puzzle that recovers the key.

In practice, I'd like to see it require judicial oversight to release the funds.

How will you ensure that botnets are brought under judicial oversight?

"But suppose we could construct a truly limited mechanism that would give them the ability to recover only a small amount of encrypted data. "

Hahahahahahahahahahahahaha.

Oh wait you're serious.

This comment broke the HN guidelines badly. Please don't push discussions into the internet swamp here. If someone is misinformed, you can correct them in a way that teaches the rest of us something, too. You can also just post nothing. But please don't post uncivilly or unsubstantively.

https://news.ycombinator.com/newsguidelines.html

Parent seems to be trying to encourage some real discussion on this topic. For those of us not well versed in crypto, could you elaborate on why this is problematic rather than being dismissive?

Why is this not possible? How could we improve the situation? What are the risks?

You don't have to resort to complicated cryptography: anything the FBI can decrypt, anyone who knows what the FBI knows can also decrypt: is is prima facie impossible to have a decryption algorithm that only works when accompanied by a valid warrant.

So that's it: there's actually no way to allow the FBI to decrypt an iPhones without also assuming hackers will (perhaps after a delay before a leak/weakness is discovered), you only get to choose "hackable" or "not hackable", there's no "hackable only by the honorable American government"

Also, it's already very hard to make things "not hackable" without deliberately introducing a certain way to hack it.

Pretty much every electronic secret the American government tried to keep gets stolen. F-35 plans, diplomatic cables, TSA’s special key, Forms SF-86 for clandestine employees...everything. It is unreasonable to expect the magic phone unlocker to not suffer a similar fate.

When one has read WaPo and watched the "Sunday conventional wisdom shows" for enough years, one gains amazing powers of self-delusion. For instance, one might be convinced that the litany of leaks you mention, and the thousands of leaks you didn't mention, were all intentional at some level. Maybe it was counterintelligence? Since you mention F-35, you might consider the fact that Lockheed made hundreds of millions of dollars "redesigning" the plane after the Chinese got all the original designs. If you wait to ask until late enough at night, some of these mooks will tell you that Snowden was some sort of 5-D chess maneuver! After one's brain has deteriorated to such an extent, why wouldn't one believe in FBI crypto magic?

He's not blaming anyone; he's saying it was stolen.

Yes 'JumpCrisscross and I are in fairly complete agreement on this issue. The counter-argument I offered has always amused me when I've seen it. I reproduced it in the hope that it would amuse you as well; sorry humor is difficult.

It seems like the discussion would need to be... what information that law enforcement wants to have classified as "limited" which the public finds acceptable to definitely be hackable by third parties who will inevitably figure out how to bypass the encryption. Even if it's just a corrupt FBI agent selling the key on the black market, all it takes is one time.

There might be some subset of things that fit this. Maybe a call record? But would the public be cool with the Russian Mafia definitely being able to get their GPS location and text message contents? Saved passwords? All your emails from the last decade? That's how I see the tradeoff and risk. There is little that the FBI would be interested in that criminals wouldn't be able to make a buck off of.

Suppose some system like this is actually possible and not just fiction. Then, the FBI still doesn't need it, because the legal system already has a way to address this problem. Warrants.

Correct me if I'm wrong, but I assumed the criteria for "exceptional criminal investigations" included the obtaining of a warrant to access said data.

Suppose some magical system like this was possible "breakable encryption, but only in the presence of a warrant". What are the arguments against this?

What if corrupt, evil, law enforcement working with corrupt, evil, judges are able to issue warrants and read whatever they want, whenever they want?

How is that a good thing? Please explain.

This is the way things have worked since the United States was formed and is written into the Constitution. Do you actually think the justice system should not have the ability to use warrants? Then you need to change the Constitution.

It needs to work for all countries, not just the US. Please continue your explanation.

All countries with a government have a warrant system. Please explain your point.

As I said: What if corrupt, evil, law enforcement working with corrupt, evil, judges are able to issue warrants and read whatever they want, whenever they want?

I think the problem I see is in there somewhere. Did I state it poorly? How could I state it better?

The point is they already can. You're proposing to change the status quo in every functioning government on the planet. Since these people are ultimately controlled by the voters, they are ultimately acting to fulfill the will of the voters.

No, they can't, at least that's what they're telling us. Some devices, they haven't been able to get into. That is the status quo. Being able to crack properly done, effectively unbreakable encryption is not the status quo, it's a fantasy.

And voting? You are assuming democracy. Also you're forgetting about the tyranny of the majority. If you aren't even going to read what I'm saying, let's just stop here.

You act like encryption is the default state. It isn't. An officer with a warrant has access to your written records in your home and stored with third parties. Why is access to encrypted data magically different and somehow magically overreach where all previous access wasn't?

>You act like encryption is the default state. It isn't.

It wasn't the default state. Past tense. You're taking a very 1980's view. The world has moved on. Sure, there are some types of data that are not yet protected, but that's a deficiency which should be corrected with time.

>Why is access to encrypted data magically different

Nothing magic about it, but it's different for a couple of reasons.

First, because a smartphone is more like an extension of your brain than it is like a file cabinet.

Second, because in the old paper world you imagine (or pretend?) we still live in, the entities interested in accessing people's private data didn't have the internet, so they would have to by necessity go to one house at a time to get written records. Now, they do have the internet, and they can hoover up everything. And they do. "They" meaning not necessarily good guys. Sometimes there are rogue cops, or haven't you heard? Not to mention black hat hackers.

So, because of this extraordinary change in how data can be accessed in bulk, and the personal nature of devices, private data needs better protection. Not magic. Just different times, with different snooping tools, different data, and different devices. So much has changed, you might as well ask what hasn't changed.

Why does encryption magically make a phone an extension of your brain when before device encryption, it wasn't? What do black hats and rogue cops have to do with warrants? Your arguments are all over the place.

Agreeing with other comments, that seems like a problem with warrants in general, not with some supposed technology. If cops can get a warrant to raid anyone's house then of course they'd be able to get a warrant to raid anyone's phone in this situation. The solution to that issue would be to fix how warrants are granted to make them less prone to abuse. But that seems like an entirely different debate.

How do you prevent against evil law enforcement?

You may foolishly think that all law enforcement is perfect... it's hard to state what I think of this level of naiveté and stay within HN rules of polite commenting.

> "Idea: Make brute force key recovery possible but very expensive"

My eyes glazed over. Quantum computing isn't a fantasy realm, and non-quantum processors are still improving.