Welcome to 1998 aka "The Clipper Chip"[0]

Also: We know how CSS, BluRay Master Keys, TSA Keys and other various signing keys fared in the wild.

[0]: https://en.wikipedia.org/wiki/Clipper_chip

Don't forget the OPM hack! The spooks compiled a self-blackmail database and couldn't even keep that secure. Yikes.

Yes, by giving the government access to one or both of the end devices. (Which is probably already a thing somewhere legally, and very likely is the factory state for some Android phones.)

Note that banning E2EE implies banning encrypted p2p communications entirely. E2EE is a concept that applies only to centralized comms providers where all messages go through a server.

Practically speaking, it's impossible to ban every encrypted protocol (TLS, SSH, ...). It's also (probably) impossible to ban IP communications that don't have an "approved server" participating.

However, comms providers / social networks to date at least manage, authenticate, and introduce users at the serverside. Fully distributed projects have problems with spam. So governments would have to ban comms providers from "allowing" their clients to talk to each other directly and not via the backend. That's a hefty technological restriction, which would block a wide range of protocols (webrtc/SIP, torrents, probably a bunch of other Very Important things I'm not thinking of right now).

If you allow the +G, you allow hackers. It's as simple as that. If you want security, you can't have backdoors.

What is wrong with the method which vbezhenar suggested? (sibling comment of yours)

Considering how all master keys of most popular measures have been hacked, its natural to assume that government keys will be hacked and leacked too.

I think you are underestimating the ability of organizations to keep important private keys private.

Some examples are the code signing keys of most major desktop and mobile operating system vendors, the package signing keys of major Linux distributions, the SSL private keys of most banks and major e-commerce sites, and the certificate signing keys of most SSL certificate issuers.

Backdoor algorithms and operators cannot be reasonably trusted to not disclose the key or data.

Yes, it is possible. You have to encrypt session key with government public key and include that encrypted data with your session. Government can decrypt that data with their private key. I think that's a pretty reasonable scheme as long as government private key managed by a competent organization (e.g. NSA). HSM makes it impossible to easily extract private key and military guard and other physical security measures makes it impossible to steal HSM.

Yeah, and that part is the pipe dream. You really need to compromise it only once to have access to everything.

It’s unreasonable to believe only the government will have access.

You implement it by putting the key inside a box, and letting that box perform the decryption. No other services/ports allowed. (Except you have to have a way to get the public key out, and allow the box to generate a private key which means it needs entropy). You can pot the box in epoxy for additional security.

Nothing that you, tzs and vbezhenar are describing is different from “end to end encryption, but with a backdoor that could be leaked”

So now you have an ultra secure box. It’s like the unsinkable Titanic. Someone (somehow) copies the key, and proceeds to decrypt all your citizens’ communications, but you are 100% that hasn’t happened, because it is, after all, impossible.

Just like it was impossible for the Titanic to sink.

Just to add another thing in: Which government?

Obviously one which can force companies to implement whatever they want. Currently it's US, EU, probably China.

You could put a check on the government misusing their private key by having the government key distributed among several parties using a secret sharing system such as Shamir's that requires several parties to agree in order to use the government key.

Include privacy or civil rights civilian organizations among the shareholders, such as the ACLU, so that there is an outside check.

If you choose a sufficient and diverse enough set of shareholders, you can reduce the chances that someone could compromise or coerce enough of them to gain access to the government key to less than 1 in N, where N is arbitrarily large. Chose N so that this is less likely than simply brute forcing the key.

Even assuming purely good intentions, the government would want to use the key very often (hundreds or thousands of concurrent investigations) and in many large unrelated organizations (eg police + FBI + NSA + CIA + DOD + ...). It would be impractical to authorize each individual use, let alone authorize it by several parties each time.

Instead we'd see 'ongoing' authorizations on the level of an investigation, a person or team, or a whole sub-organization (modulo clearance / position in that organization). And so you'd have copies of the complete key going around.

The problem with E2E+G is not technical, it is political. It can be done in a way that it would only be practical for the government to use it rarely (E.g., [1]) and only for cases where there is a broad consensus that it is being used Constitutionally (or whatever is equivalent outside the US).

But getting Congress (or whatever is equivalent outside the US) to pass an E2E+G law that allows it to be done in such a way seems unlikely. They will go for a way that allows broad use.

[1] You could make it a per-device key, generated on the device itself. The device makes the Shamir secret sharing shares, encrypts them with the public keys of the shareholders, and periodically includes those includes those in the chat metadata.

To decrypt a chat, the government needs to record it, get the encrypted shares out of the chat metadata, get each shareholder to use that shareholder's private key to decrypt their share and then contribute that share for recovery of the actual chat key for that chat.

If they want to decrypt a chat from another device, they'd have to do that all over again for that device.