Supposing governments can hold secrets and no rogue employees exist, can a back door in an end-to-end communication protocol be kept secret and not be abused by criminals as well, as often supposed?
As this lead to confusion in the comments: This question is not necessarily about a back door to a system or hiding the network traffic of such a back door in end-to-end encrypted protocols but rather surveillance means of governments that could be abused by criminals to gather PII, for example.
Your assumptions are wrong: neither are governments good at keeping secrets nor do they have no rouge employees.
Yet, let‘s assume your assumptions do in fact hold.
How such a back door might look exactly is highly dependent on what protocol you are trying to compromise the secrecy of.
So let’s keep it abstract:
For eavesdropping on end-to-end encrypted channels, there has to be a weak spot in one of the following parts:
The crypto itself.
Using weak cryptographic systems such as the infamously fast Double ROT13 encryption scheme allow for eavesdropping. Yet, everyone implementing it must know about this and everyone sniffing their own network traffic can see it.
There are however more “stealth” ways of using weak cryptography, though crypto systems are usually very thoroughly researched before they go into production. They are also usually open source and well reviewed; anyone can check them out and see wether there is a weak spot - and switch to another product using strong crypto if they do.
The trust model.
For the key exchange to work (and knowing you talk to the person you are supposed to, not e.g. a government as a MITM), you do often have to rely on a third party that vouches for the identity of the counterpart of your conversation. Being it a CA or the web of trust or the apple or Facebook or WhatsApp servers, you do base your trust on something. So this seems like a good point to introduce false keys, MITM’ing all conversations.
The problem here is that most end-to-end encryption capable clients do allow the user to check the key fingerprints in person or over another channel with the entity they are supposed to belong to; Threema even denotes this - and only this - as “green”, where getting the keys from the server alone is just “yellow”, in their trust model. Whatsapp allows that too and warns users when keys change (e.g. when the phone is switched). So this would be easily detectable as well, with the same consequences as in 1. - the users just switch to a different Service wreaking havoc on the services business plan.
The endpoints.
Compromising the endpoints might be the most plausible way of breaking end to end encryption, yet this amounts to a massive undertaking in a broad deployment as a single point of failure does not exist - unlike on the other options.
Now, the real problem is: even if such a back door is implemented, there will be researchers finding it sooner or later. Maybe they will think it’s a bug, not a feature, but it will be found and will be exploited, especially when used in the wild and on a broad basis.
Remember that this technology is neither delivered by only one vendor nor is software bound to laws of a specific country and can be easily reproduced even if forbidden in a country.
Simply put: you cannot have your pie and eat it, too. If you put in a back door, it is there - and others will find it.
