Alex Marcham | Network Architecture 2020

Banning Cryptography: Fact and Fiction

August 20, 2017 1 Comment

Every so often, usually after a national security event, prominent political voices in many countries will emerge to decry the availability of encryption software and its uses for nefarious means. They reason that as such software could be used to hide the movements of those wishing to commit crimes, that the concept of cryptography which law enforcement does not have ready access to should be banned, forcing all users to utilise insecure platforms with backdoor access built in.

On many levels, this is a reasonable assertion; ignoring the sizeable challenge it represents to the concept of privacy in digital communications, the idea is not completely ridiculous on its face. Law enforcement has been able to intercept communications for centuries, from letters to telephone calls, after all. However, today’s network communications have a significant difference.

In the past, cryptography – and other methods of hiding the intended content of a message from all other than the intended recipient – were almost exclusively the domain of the military and other secret services. The principles of cryptography were not widely known, not taught, and kept hidden from the outside world for as long as possible.

This began to change around the middle of the 20th century, as interest in cryptography grew and civilian research on the subject increased. Happening in concert with the availability of home computers, this brought about many knowledgeable civilian researchers and practitioners of cryptography where none had existed before.

Today, devices used for sending and receiving private, public, even military and government communications use a cryptographic cipher – the complex system which encodes and decodes a plain text message – designed by a civilian research team. The Rijndael cipher was chosen in 2001 as the basis for the Advanced Encryption Standard (AES), used in many military and government networks across the world.

This and other ciphers are freely available for others to implement today, without requiring the blessing of or any information from a military or government organisation. What’s more, very few (if any) organisations are known to be able to break ciphers which are recommended for usage today with an appropriate-length key in anything approaching a reasonable amount of time, under many hundreds of years.

So, with the widespread public availability of very competent cryptography, both public and private key (so messages can be protected whether or not the intended recipient has a shared private key) the situation today is very different from the past. Now, novices with no knowledge of cryptography whatsoever can utilise easily-accessible encryption software and send messages that for almost all intents and purposes are unreadable except by their intended recipient.

If legislation were enacted banning the use of these programs, the following things would then occur:

1. The legislation would have to specify a replacement cipher to be used, as cryptography has been a necessary part of enabling the widespread use of network communications for sensitive information such as financial transactions.

2. This replacement cipher would then need to be breakable by a government organisation, either by an intentional backdoor in the cipher or via mandatory usage of a short encryption key.

3. Anyone, such as criminals, who was sufficiently interested in still retaining their secure encrypted communications could still use software implementing the more secure ciphers, as the mathematics, design and code required to do so is widely available already.

With these points in mind, we can see that the only people disadvantaged by such legislation would be everyday legal users, who now have their security compromised by the use of a weaker cipher. If the history of designing complex systems (as cryptographic systems certainly are) has taught us one thing, it is that if a vulnerability (such as an intentional backdoor) is present in a system, more than the intended party will eventually find it.

This is why cryptographers are continually at odds with government organisations on the subject of back doors; to be able to provide one user with unfettered access as is so often requested, the door is opened to anyone interested enough to find it; and with cryptographic schemes would could be mandated for the majority of network communications in a country, there is no shortage of interest.

So, what can realistically be done about the problems law enforcement faces with secure cryptography communications? While the mathematics and system design of cryptographic ciphers are thoroughly vetted for many years by the academic, private and public communities of cryptographers, one area is typically not: the application implementing these systems and ciphers.

Indeed, there is a thriving underground market for known exploits of these applications which would allow unintended users to gain access, and the developers and operators of these applications are also under continuous pressure from government organisations to open access to their data in transit and at rest.

The most likely method of success for government organisations to gain access to data of interest is to covertly contact these developers and operators, compelling them directly to provide access to data in a way that does not alert the users of the service.

Although this method is arguably more legwork than simply providing a cryptographic backdoor and outlawing strong encryption, it is far more realistic. There is no real way to ban the use of strong encryption on today’s internet, and attempting to do so only further disadvantages honest users while handing the leg-up to those with criminal intent.

The next time you read an article with a lawmaker and a cryptographer arguing over the issue of outlawing encryption, think about what both sides are saying. Lawmakers (mostly) don’t want to leave the public without any method of protecting their private information, and cryptographers (mostly) don’t want to completely lock out law enforcement agencies from accessing information to protect people either.

In this situation, the problem is one of understanding: cryptographers cannot wave a magic wand and add a police-only backdoor to all the mathematics underpinning the design of a modern cipher without it being discoverable by anyone. The sooner this is more widely understood, the sooner we can get to discussing real solutions to this problem.

1 thought on “Banning Cryptography: Fact and Fiction”

  1. I have a new cryptography technology capability with 4 issued patents that is multidimensional: X, Y & Z information based. The “Z” is what garnered all the patents as a Novel breakthrough.

    Our company is looking to discuss a licensing arrangement with a large established company in cryptography as the areas we are focused upon has more to do with document authentication and security as starters.

    The technology is an invention, very new and has been used commercially for tyhe past 4 yaers; so we know it is past proof of concept and works. Yale University, for example, has applied our technology and are extremely pleased along with the Library of Congress – to name a few of many.

    But cryptography is not our focus today – we would prefer to enable a major global player. The technology is impenetrable.

    Reply

  8. Terrific write ups, Thank you!
    http://canadianpharmaciesnnm.com/
    best online pharmacy canada pharmaceutical online ordering global pharmacy canada canadian pharmaceuticals online
    canadian pharmacies that ship to us
    canada online pharmacies
    no 1 canadian pharcharmy online
    canadian pharmacy no prescription
    mexican pharmacies online
    global pharmacy canada

    Reply

  20. This is nicely expressed! !
    http://canadianpharmaciesnnm.com/
    canadianpharmacy canadian pharmacies web medical information canadianpharmacy
    rx pharmacy
    no 1 canadian pharcharmy online
    walmart pharmacy price check
    pharmacy near me
    <a href="http://mecetes.org/?s=+Whoa+plenty+of+valuable+knowledge.+http%3A%2F%2Fcanadianpharmaciesnnm.com%2F+canadian+pharma+companies+canadian+online+pharmacies+pharmacy+near+me+canadian+online+pharmacies+%0D%0Acanadadrugs.com+pharmacy+%0D%0Acanadian+viagra+%0D%0Acanadian+pharmacies+top+best+%0D%0Aonline+pharmacies+canada+%0D%0Acanada+pharmacy+online+no+script+%0D%0Aonline+canadian+discount+pharmacy”>online pharmacy canada
    no 1 canadian pharcharmy online

    Reply

  21. You actually reported it well!
    http://canadianpharmacysilo.com/
    mexican pharmacies shipping to usa north west pharmacy canada best online pharmacies canada canada pharmacy online
    reputable canadian mail order pharmacies
    prescription drugs without prior prescription
    online pharmacies
    price prescription drugs
    canadian pharmacy 365
    top rated online canadian pharmacies

    Reply

  26. Seriously quite a lot of good information!
    http://canadianpharmacyntx.com/
    medication costs canada pharmaceutical online ordering canadian mail order pharmacies canada pharmacy
    online pharmacy without prescription
    legitimate online pharmacies
    best online pharmacies canada
    best online pharmacies canada
    canadian pharmacies that ship to us
    online pharmacies

    Reply

  29. Point effectively taken!.
    http://canadianpharmacyntx.com/
    prescription prices comparison global pharmacy canada trust pharmacy canada canadian pharmacies online
    prescription drugs canada
    pharmacies near me
    reputable canadian mail order pharmacies
    prescription drugs without doctor approval
    discount drugs online pharmacy
    canadian mail order pharmacies

    Reply

  30. Amazing a lot of useful data.
    http://www.canadianpharmacymsn.com/
    prescription drugs prices north west pharmacy canada discount prescription drugs online top rated canadian pharmacies online
    canada pharmacies online
    canada pharmacies prescription drugs
    mexican pharmacies online
    canadian pharmacy viagra
    medical information online
    onlinecanadianpharmacy.com

    Reply

  38. Appreciate it. Plenty of content!
    http://canadianpharmaciescubarx.com/
    canadian online pharmacy reviews canada drug online canadian pharmacy canada pharmacy
    canadian pharmacy no prescription
    best canadian prescription prices
    best non prescription online pharmacies
    cheap drugs online
    mexican pharmacy online medications
    canadian drugs

    Reply

  40. Very good info. Thanks!
    http://canadianpharmacymim.com/
    cheap prescription drugs aarp approved canadian online pharmacies legitimate canadian mail order pharmacies canadian viagra
    prescription drugs canada
    cheap prescription drugs
    best non prescription online pharmacies
    buy drugs online
    online drugs
    canada pharmacies online pharmacy

    Reply

  41. You actually explained that exceptionally well.
    http://www.canadianpharmacymsn.com/
    mail order pharmacy canadian pharmacies-24h top rated canadian pharmacies online top rated canadian pharmacies online
    costco pharmacy pricing
    canadian drugs without prescription
    best canadian mail order pharmacies
    pharmacy online store
    prescription drug price comparison
    drug prices comparison

    Reply

  53. Whoa quite a lot of great information.
    http://canadianonlinepharmacynnm.com/
    canadian online pharmacy reviews canadian online pharmacies mexican pharmacy online medications canadian pharcharmy
    mail order pharmacy
    best online pharmacy stores
    canadian online pharmacies
    no 1 canadian pharcharmy online
    online pharmacy no prescription
    prescription drug assistance

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *