After the recent terrorist attacks in Paris a lot of high government officials and even prime ministers are calling for new laws to allow them to decrypt any kind of communication if it is deemed necessary. That makes me wonder if we are headed for another crypto war!?
I find it highly disconcerting that governments of liberal and democratic countries are seriously considering to outlaw private communication, a basic human right in a feeble attempt to improve security. Perhaps this thinking still comes from the days when wire tapping was the main means to intercept communication. Still today, a court order can get you a tap on anyone's phone line or mobile phone in the country and conversations can be recorded and listened to in real time. It was a different world then. No mobile computers, dumb 'terminals', you had to use the fixed infrastructure that was in place, encryption systems for the masses were none existent. From that point of view I can understand the push to get the same means for other forms of communication that have sprung up in recent years, too. But the world has changed dramatically over the past decades. Networks and services have split, dump 'terminals' for fixed line networks with voice only capabilities have become smartphones and strong encryption is used everywhere and is the foundation for our global economy today. Applying the principle of wire taping to other forms of communication would effectively spell the end of free and democratic societies as we know them today and would have a profound impact on everybody's lives, whether, even for those who claim that they have nothing to hide. So here are a couple of points why attempts to increase security by requiring a second key for governments is hoplessly useless and has become impossible to implement:
Classic Wire Tapping And Crypto Phones
To stay with the classic wire tapping example there's nothing to stop people from using crypto-phones today to encrypt a phone conversation. This is very different from 30 years ago when such technology was simply not available to everyone. Government officials have a need for this today to keep their conversations private, people working for companies around the world have a need for this today because they have a need to keep sensitive information private. As a consequence, people like you and me who are no less important and who have the same rights should therefore also have the right to encrypt their phone calls without anyone being able to tap in somewhere in between, not in the least because privacy is a basic human right. The proposals above would mean that such crypto-systems have to have a second key that the government can get access to. So who produces crypto equipment and software and how do you ensure no foreign governments and other entities eventually get the key? That makes me actually wonder which government should get the key? And what if I travel abroad with my mobile phone, should the government of the country I travel to get the key as well? If not, how could you stop to foreigners in a country to call each other and use cryptography which has a second key for their home country but not for the country they have traveled to?
Instant Messaging
Let's venture a bit further out to instant messaging. Let's say Google, Apple, Microsoft, Facebook and all others are suddenly required by law to give governments (plural!) access to private conversations and to prevent people from using end to end encryption. But how would they stop people from using a further layer of encryption over their government pseudo-crypto? They can't. Governments could outlaw such overlays but that again would violate my human rights for privacy.
Next example: Today, I'm using a private instant messaging server at home and end to end encryption for communication with close relatives and friends. With a crypto-intercept law in place, would I have to give a second key from all clients to the government? Or would there be an exception because I'm not a commercial service provider? And if so, what keeps the bad guys from just not being a commercial service provider themselves? And further along those lines what keeps anyone from using an instant messaging service for which the server is located in a country that is not on good terms with the government of the country you currently reside in? Does that mean that ISPs will be required to block their users from using such services? And how exactly should that work, clever protocols would just look for a way around.
Secure HTTP
Another example: I have a web server at home and access it using https. On my devices I use Certificate Patrol to ensure that a certificate change required for interception is indicated and communication is aborted. Would crypto-intercept mean that programs like Certificate Patrol are outlawed? And if so what keeps me from installing it anyway? As it's a passive method to ensure privacy there's not even a way to detect it from the outside. Or would such a law require me to give my private SSL key to the government? And what if I travel from Germany to Austria, would that mean that I had to send my private SSL key to the Austrian government as well? Doing so would require an encrypted connection. But then the German government needs to listen in. So would the Austrian government thus have a second key for the German government and for all other governments of nations from which people come to visit Austria? and what about the transit countries over which the encrypted communication flow is transported? It's getting absurd pretty quickly
Secure Shell
Yet another example: To administer my servers at home I use the Secure Shell Protocol (SSH) like millions of other system administrators. It uses perfect forward secrecy and certificates for the server and the client and strong public/private keys. Unlike secure http where man in the middle attacks with government signed certificates are possible, SSH is bullet proof in this respect. Does that mean that I have to give the government a second key whenever I set up a new server or change my certificates? What happens when I travel to France or Russia? Do I have to give those governments my keys in advance? Or maybe a law should be in place to require ISPs to block all ciphered communication over country borders for which no second key is available to all the governments over who's territories the data packets are sent!? Good luck working out a mechanism for that.
The only way to enforce this is to ban the use of any crypto-system that does not contain a second key for the government of the country you currently reside in. That will make traveling with computing equipment across national borders pretty difficult to impossible unless you come up with a system where governments around the world can get a key for your communication. Does anyone really want that!? Would it even be possible?
Would 2-nd Keys To Intercept Traffic of Large Internet Companies Change Anything For The Bad Guy?
These are just a couple of thoughts that show how ridiculous it would be to require big Internet companies to give second keys to governments. The overhead to play this game with 200 countries is ridiculous, the potential for fraud enormous and instead of 1.000.000.000 ways to communicate securely, bad guys would be left with only 999.999.999.
Less Is More
In the end, the only way is to tap the bad guys at the source before data is encrypted. That is not trivial but it shouldn't be anyway as otherwise governments would just spy on anyone. After the Snowden revelations there is little if any doubt on that. When looking at terrorist incidents I can't find a single one after which it is discovered that the terrorists were already known by the authorities but manpower was missing to have a closer look. There is no need to ban encryption to get even more data, police can't even handle the data they already have access to. So in my opinion they should even be required to collect less data rather than more for their own sake.
