There is a lot of information circulating the Internet about a US bill the Obama administration plans to submit to lawmakers next year. This intent of this bill is to give law enforcement access to clear text data similar to a wiretap when criminal activity is suspected. In and of itself, that seems to be a notable and noble effort. However, in practice this bill cannot and will not work. Additionally, it will negatively impact the Internet and the Internet community by weakening the crypto of the normal everyday user.
Link to the Electroninc Frontier Foundation Article:
This is one of those things that the more you think about it, the worse of an idea it seems to be. Like most, I want to protect the world from sexual predators and would like to see illegal drugs as well as organized crime cease to exist. So what if the government requires a back door process, or even just the software author, to produce clear text data from all cipher text processes? Doesn’t seem like such a big deal on the surface. However, since such a process would exist, it can and will be exploited. What if software vendor xyz is required to create a back door into its software that it would use when a court issues a subpoena? Do we trust all employees that work for xyz? What about ex-employees of xyz? Additionally, what external entity might extort company xyz to produce clear text data?
So thinking about the production of software, another problem arises. What about open source software? Who is the trusted entity if a trusted entity is permitted with decryption capabilities? The answer is everyone. So do we eliminate open source software for anything that requires encryption and just trust commercial vendors with their limited peer review process?
Those are just a couple of examples of things that I see that is wrong with the concept. So what benefit would this provide us? Not really anything from what I can tell. Basically all encryption would have to be from an authorized vendor that has a decryption process in place. However, the long and short is that it is very difficult to stop crypto traffic from flowing. Current crypto traffic is pretty easy to recognize and because we are allowed to use it. However, if unauthorized crypto had to be blocked there are a lot of work arounds. For example, what if crypto traffic looked like a normal web page? What if we had a GIF image in which a person with green eyes had one value, while a person with blue eyes had another value. Maybe we can throw some more characteristics in there to build more entropy and to build a crypto table that is completely undetectable. We can certainly do this (although it will require more overhead in terms of bandwidth and processing), and it will happen if authorized crypto is weakened by the any back door techniques.
This is one of those things that I could spend hours and hours writing about the issues and still not cover them all. The more I think about this, the more issues I see with doing it. I am just concerned that whilethis bill may look good on paper to those in law enforcement, in practice it will not have the desired effect. In my opinion, the main issue is lack of understanding. As security professionals, I think we need to make sure that others are aware of the issues with this approach. I certainly hope that those sponsoring this bill have good trusted advisors and that these advisors make them aware of ALL foreseeable issues.