8

It has been rumoured (I guess it is more than a rumour) that senators Burr and Feinstein will be introducing legislation requiring companies to provide the government (with warrants) access to encrypt material. So, one could maybe expect the government to require that companies keep a masterkey that can unlock all encryption. We don't have the exact language of the bill yet, and the White House might even oppose the bill already.

But, I am a bit confused about the implications of such legislation. While I understand that one can require Apple, Facebook, Google, etc. to basically implement backdoors in the encryption scheme, what would such a policy mean for encryption?

Would it, for example, be reasonable to assume that such legislation would basically ban strong encryption? There are so many programs out there that has implemented various strong algorithms (like PGP). Is the consequence of such legislation only that the default encryption used on, for example iPhones will have a backdoor?

Is it even practically possible to outlaw all strong encryption?

To be clear, I am not asking about whether or not one should support such restrictive measures. I am only interested in what the implications of such legislation would be.

Improve this question
7
  • 5
    Legal questions are off-topic here, and without the text of the bill it would be impossible to even speculate remotely accurately. Additionally, bills can change considerably between introduction and passage, so even with the text of the bill speculation would be premature to address in our Q&A format.
    – Xander
    Mar 23, 2016 at 16:40
  • 4
    @Xander: So asking about implications of laws and policies are off topic?
    – Thomas
    Mar 23, 2016 at 16:42
  • 3
    @Xander True, but I think what he is really curious about is what would happen if the government were to pass a law requiring either backdoors, a masterkey to unlock encrypted data, or banning use of all strong encryption.
    – dakre18
    Mar 23, 2016 at 16:43
  • 4
    I don't see this as a legal question, but more of a speculative question about the ensuing shit-storm that would be inevitable. Assume it's legal, and think about what would happen.
    – Steve Sether
    Mar 23, 2016 at 16:45
  • 1
    @PhilLello That's the legal aspect, which again, he's not asking about. He's asking about how that would affect the internet, the world, or even the US in general. Or how it would affect individuals to give another example.
    – dakre18
    Mar 23, 2016 at 16:49

2 Answers 2

Reset to default
9

I think the really interesting implications are when you look outside the US. Once the mechanism is in place to legally request a key or decrypted content, the other countries where affected companies do business are going to require the same thing.

The method used to provide decrypted content will impact what happens next.

  • If the company keeps its keys secret and decrypts user content on request, you'll end up with a situation where the company is required to respond to decryption requests from all sorts of foreign agencies, and some of those will probably be for devices belonging to citizens of the company's own country.
  • If the key itself has to be provided, and the company only maintains one master key for all its products, then you have a situation where governments have the ability to decrypt devices belonging to foreigners (including, say, government officials or C-level executives)
  • If the key itself has to be provided but there are separate keys (either per-device or localized to a country) then in order to preserve their ability to read their citizens' devices, countries would have to make importation of encrypted devices illegal (and, practically, you end up with a situation where the "bad guys" (like terrorists and secret agents) just import phones illegally and have perfect encryption and only the "good guys'" devices can be decrypted). To allow legal travelers to bring their devices into the country, you may also need to create a key management system to import into or retrieve keys from each device (and of course, "you must run this program on your computer to be allowed entry into our country" has additional implications).
Improve this answer
2
  • 5
    An additional, related consequence you might want to consider in your answer: what it'd mean for travel (especially business travel, or moving) if you could no longer bring a phone, laptop, etc. across a national border ("import" it).
    – derobert
    Mar 23, 2016 at 18:27
  • What I don't understand is, can't other countries already pass laws like this anyway? Why should that be significantly affected by what happens in the US?
    – user541686
    Mar 23, 2016 at 22:42
2

Things like corporate S/MIME mail servers, or corporate disk encryption would already be compliant with this.

In systems I've worked with (which I'll leave unnamed) key generation for an end-user works like this:

  1. Signing / Nonrepudiation private keys are generated at the client-side and never shared with anyone.

  2. Encryption private keys can either be generated server-side and securely passed to the client, or generated client-side and securely passed to the server. (A server admin can configure it to have decryption keys be stored client-side only, but you would never do that for the data-recovery reasons listed below.)

  3. Decryption keys are archived on the server, encrypted with a master server key (which hopefully is kept in an HSM).

    • In the event that a user loses / destroys their keys, any documents encrypted for them are not lost because the server can restore their decryption keys.
    • In the event that some 3rd party wants access to documents encrypted for them (for example, if the employee leaves, or corporate execs want direct access, or there's a government warrant), decryption keys for that user can be retrieved directly from the server by a high-level admin.

The implication here is that if you work for a company; your data was never yours to begin with, it has always belonged to the company, and they have a right to access it.

The other case you're asking about is private citizens using personal encryption tools like PGP. This is where the shit-storm happens. Is US law-enforcement trying to give itself the right to say "Give us the decryption keys to see the evidence, or we're sending you to jail for using encryption!" ? That would be terrifying, and deserving of public outcry, but as mentioned in comments: this is definitely off-topic for this site, so I'll stop here.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .