It is impossible to construct a cypher with just one key, such that the good guys (spanning several allied nations, dozens of government agencies, perhaps even local police) can use the key, but bad guys (spanning several opposing nations, dozens of intelligence agencies, thousands of hacker groups, tens of thousands of individual cyber-criminals around the world) cannot. We are talking about every single person who can buy a copy of a piece of paper carried out of HQ being able to read all of your personal and professional correspondence: no doubt a possibility.

You're missing my point completely.

These folks very well understand that bad people can steal keys. Stolen keys have been a thing since antiquity. It's not rocket science they don't understand. Every single key in history has had a risk of theft and this is no exception.

The truth is a lot of them understand this just like you. But unlike you, they are willing to accept this risk. You aren't. That's fine. You have a value disagreement -- you don't think the risk is worth it, and they think it is. Which is why you make arguments about the merits of the issue, instead of attacking the other side on their basic literacy. Just because you disagree on values that doesn't mean the other side is stupid or illiterate about the basics.

This isn't about politeness either, it's actively counterproductive to your own cause: insulting people and showing that you lack a basic understanding of their position is a sure-fire way to make sure they dig their heels in and continue to oppose you regardless of the merits of the situation. i.e. it's a grest strategy for losing in the end.

I don't believe that France is actually willing to accept that every opposing intelligence agency will obtain the key...

Maybe they don't think it's as likely as you think. Or maybe they think the time horizon is long enough that it is worth it. Whatever it is, I assure you they are not too stupid to realize this is a possibility. They just differ on either the degree of the risk, or on the value they get in return. In which case, logic dictates that if you believe the actual risk is higher than they would tolerate, to find a way to convince them of that.

That's a matter of facts rather than values. The "impossible promise" is that a private company can keep a kilobyte of data out of the hands of every spy agency on Earth for any length of time.

Why does this concern apply to the French intelligence agency but not, say, the code signing certificate for Whatsapp?

On one level it does apply to certificates.

On another level, pushing a compromised update to every phone in Europe (to gain access equivalent to having a copy of the backdoor) would be noticed by the publisher, and the binary difference would quickly be found by security researchers.

And yet the immense majority of the population accept & use messaging platforms operated by "not France" where the operator would be able to obtain everyone's key with a couple clicks. (Yes, this includes Apple's).

That makes sense because it has been brought about as a consequence of consumer preference. It wouldn't make sense for it to have been required by the government.

Unfortunately, last time I heard, consumers actually dictate what the government cares about.

I think they think when that happens they'll change it. Or they'll change it on a schedule... "Just use HTTPS" is good enough for every website and web app on the planet (including ones that handle more messages than the entire country of France) but not a state intelligence agency can't keep their TLS keys secret?

"Just use HTTPS" sends French messages directly to NSA, insofar as those platforms are concerned. In that case there's not even a copy of any encryption key...

France is giving everything they receive to the NSA anyway, so there's not much difference.

This is spot on.

They're not concerned about their own security. They believe that they will have access to tools that will make them safe, but that "those people" will be deterred, and it is acceptable to give up some basic safety for many to catch "the bad people."

And, historically, they weren't necessarily wrong. The problem is more that all of the tradeoffs and probabilities from history have been thrown at the window, because it is now trivially easy to phish the majority of a population and getting a master key gives you access to hundreds of millions of individuals that you can reach from around the globe rather than a couple dozen that you can get to in person from a particular apartment complex.

Understanding encryption is not the problem. Understanding scale is the problem.

> It is impossible to construct a cypher with just one key […]

Technical nit:

I (mis?)remember reading in a cryptography book (by Schneier?) that the NSA has at least one algorithm where the decryption key is different than the encryption key, but my search-fu finds no references to it online. The application would be for devices in 'hostile territory' where there was a risk of capture of the unit and so you didn't want the other side to be able to alter data/firmware since the cipher that is available is decrypt only.

However, see perhaps:

* https://crypto.stanford.edu/~dabo/abstracts/traitors.html

* https://crypto.stackexchange.com/questions/39397/one-encrypt...

Also, see n-of-m algorithms:

* https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing

the problem with backdoored encryption isn't making a cypher with multiple decryption keys. It's keeping secret that's worth billions of dollars and shared among 10s of thousands of people. The difference between backdoored encryption and no encryption is whether the backdoor is known to the public.

There is a coherent set of values that lead to saying "no encryption", but not one for "only backdoored encryption".

> There is a coherent set of values that lead to saying "no encryption", but not one for "only backdoored encryption".

While I oppose building backdoors, I don't really agree with this claim. There's nothing incoherent about developing a threat model.

I think some threat models, like one that doesn't include hackers, are not coherent relative to reality.

A threat model can include hackers while not taking every action that could prevent every conceivable attack from a hacker.

Your government isn't the only one out there. If your government can have a backdoor, so can every other government. If the US, EU, Russia, and China all have backdoors to everything, who are you keeping it secret from?

The powers that can't pay? If the US, EU, Russia, China all have nukes to everything...

Could it be possible to make a cryptosystem where messages can be decrypted either with the recipient key, or by sequentially applying say, 100 different backdoor keys, such that the different backdoor keys could be stored on different machines without ever being present on the same machine?

If you increase the number of backdoor keys needed to decrypt by enough, and have these keys be stored only on hardware that is meant to make it infeasible to extract the key from it, and if these machines are distributed among a sufficiently large and varied group, maybe that could work as reasonable oversight to prevent the backdoor from being used outside of select cases?

Edit: to be clear, I don’t want this. Just trying to map out what positions could reasonably be held / what options there are.

I upvoted because I don't think you should be censored, but I kindly disagree :-).

To me (and I think that's the position of cryptography-aware people), requesting a backdoor is a risk so high that it makes absolutely no sense.

Of course, they understand that if an adversary gets access to the backdoor, then it's game over. And of course, they believe that it's possible to prevent the adversary from accessing the backdoor. But that's my whole point: their believing this means that they don't understand the problem.