106

In the documentary film Citizenfour, Edward Snowden says about documents:

I'm comfortable in my technical ability to protect [documents]. I mean you could literally shoot me or torture me and I could not disclose the password, even if I wanted to. I have the sophistication to do that.

What technology/methods exist that would enable the scenario Edward Snowden is referring to when he claims to be able to create a protected file where he cannot disclose the password?

  • 19
    As pointed out in an answer below, the type of attack Snowden envisages is called “rubber-hose cryptanalysis” (a euphemism for torture, see en.wikipedia.org/wiki/Rubber-hose_cryptanalysis). You may want to edit the title to be more specific. – MatteoS Mar 4 '15 at 17:04
  • 1
    KeePass generates passwords so long and complex, I could not possibly memorize all of them. I rarely even see my passwords. It does have a master password though. If he is kidnapped, he would not have access to the passwords for a specific document or site, but he could be coerced to provide the master password. – Chloe Mar 5 '15 at 2:40
  • 19
    Relevant to this discussion: xkcd.com/538 – Sobrique Mar 5 '15 at 10:49
  • 4
    Any system where only 1 person is needed to get access is vulnerable to the rubber hose, you can torture someone to go through the steps of decryption. – ratchet freak Mar 5 '15 at 16:57
  • 5
    another relevant comic static.fjcdn.com/pictures/Korean_ca37a1_872460.jpg – jhocking Mar 5 '15 at 21:27

11 Answers 11

84

Shamir's Secret Sharing is a method for this. It allows one to encrypt a file with a public / private keypair, and then effectively split up the parts of the private key to be distributed to several different people. After that action (and assuming the various parts and original input private key are destroyed after distribution), it would require a quorum of people to act together in order to decrypt the data.

  • 43
    Or a quorum of people to be tortured. It makes that attack harder, not impossible. – PlasmaHH Mar 5 '15 at 9:07
  • 14
    @PlasmaHH If you consider rounding up and torturing everyone whom you shared the partial key doable for that adversary, then there is no defence against it getting access to your data, other than to make it impossible to decrypt by yourself as well. If you can decrypt it and they have unlimited power over you, they can decrypt it too. – March Ho Mar 5 '15 at 9:35
  • 26
    @PlasmaHH Willing and able are completely different. The US government is willing to torture all of the Taliban and ISIS commanders, but is unable to do so. – March Ho Mar 5 '15 at 10:57
  • 12
    Low efficacy of torture is a serious problem here. – Palec Mar 5 '15 at 22:25
  • 3
    @Aron: The key itself is easily verifiable, but people usually don’t remember their keys. They store them somewhere. And getting the key from a remote location is not as fast and easy. – Palec Mar 6 '15 at 7:53
61

All of our answers are speculation, of course, but I suspect that the most likely way that the documents are protected are by following Bruce Schneier's advice regarding laptop security through airports:

Step One: Before you board your plane, add another key to your whole-disk encryption (it'll probably mean adding another "user") -- and make it random. By "random," I mean really random: Pound the keyboard for a while, like a monkey trying to write Shakespeare. Don't make it memorable. Don't even try to memorize it.

Technically, this key doesn't directly encrypt your hard drive. Instead, it encrypts the key that is used to encrypt your hard drive -- that's how the software allows multiple users.

So now there are two different users named with two different keys: the one you normally use, and some random one you just invented.

Step Two: Send that new random key to someone you trust. Make sure the trusted recipient has it, and make sure it works. You won't be able to recover your hard drive without it.

Step Three: Burn, shred, delete or otherwise destroy all copies of that new random key. Forget it. If it was sufficiently random and non-memorable, this should be easy.

Step Four: Board your plane normally and use your computer for the whole flight.

Step Five: Before you land, delete the key you normally use.

At this point, you will not be able to boot your computer. The only key remaining is the one you forgot in Step Three. There's no need to lie to the customs official; you can even show him a copy of this article if he doesn't believe you.

Step Six: When you're safely through customs, get that random key back from your confidant, boot your computer and re-add the key you normally use to access your hard drive.

And that's it.

This is by no means a magic get-through-customs-easily card. Your computer might be impounded, and you might be taken to court and compelled to reveal who has the random key.

To be even more secure, Snowden himself may not know who has the backup key--as the associate he gave it to may have passed it along elsewhere. Also, it is likely that the person that did receive the backup key from Snowden is in a different country than any likely attacker and is doing his or her best to stay very safe.

EDIT: In response to the below comment, I decided to add the following advice:

Create a dummy operating system that starts at the beginning of the laptop's hard drive. The encrypted operating system with sensitive information will be the following partition. Configure the laptop's bootloader to boot from the dummy operating system without your intervention.

TrueCrypt had a similar hidden operating system feature where the TrueCrypt bootloader would accept two different passwords, giving access to two different operating systems. The hidden operating system was concealed with a bit of clever steganography.

We can do something similar in Linux and LUKS, but without the steganography, by doing the following:

  1. Installing Linux twice--on two partitions.
  2. Encrypting both of them with LUKS.
  3. Configuring the bootloader (probably GRUB2) to boot the first Linux installation, and remove the entries for the second installation.
  4. Whenever you want to boot your second, secret installation, boot your laptop and reach the GRUB screen. Modify the bootloader entry (temporarily) directly from the boot screen to point to the second partition.

Step four is not very user friendly, and we could get rid of it and make a separate bootloader entry for our secret operating system, but then anybody that looked at the screen could tell that there are two operating systems on the machine. An investigator can still tell, but now they must look at the laptop's hard drive with a partition editing tool.

  • 17
    If your laptop is not bootable, they might not allow you to take it aboard. – Kevin Krumwiede Mar 4 '15 at 23:45
  • 5
    My LG G2 phone has a UI like that. One pattern/pin takes you to guest mode and another pattern/pin leads to your normal account. Once a user is taken to guest mode, that user has no idea he is in guest mode (assuming you didn't uncheck any of the normal pre-approved apps on your phone). And even if you do pre-approve all the apps to work in guest mode, a user in guest mode won't have access to any of the data held from your normal account. – Stephan Branczyk Mar 5 '15 at 12:10
  • 3
    What about giving out a "self-destruct key" as is envisioned in different disk level encryption schemes. You just give it to them and they destroy all the data. There is a flaw somewhere probably, maybe cloning the disk would make this irrelevant, as they still have another copy to try it again. – WalyKu Mar 5 '15 at 18:36
  • 7
    @Kurtovic The disk is guaranteed to be mirrored by any government-level attacker, simply because that is what a sensible person would do. Either way, attempting to destroy the ciphertext when detained may incur legal penalties. – James Mishra Mar 5 '15 at 21:11
  • 12
    STEP TWO Solve the key sharing problem. STEP THREE PROFIT. – Aron Mar 6 '15 at 1:30
37

Here is an original technique I have come up with that can survive a rubber-hose attack:

  1. Get a stack of cash, about 50 one-dollar bills. Maybe mix some fives and tens in with them.
  2. Shuffle them into a random order
  3. Derive a password from the serial numbers, for example by taking the two least significant digits from each bill in order to form a 100-digit number
  4. Use this password as your encryption key
  5. Keep your cash in a neat stack next to your computer.
  6. If government agents raid your home, they will take the cash. With a bit of luck, it'll simply vanish into a policeman's pocket, never to be seen again. But if you get an honest cop who checks it into evidence, it's still going to be sorted and counted; it is very unlikely to maintain its order through that process, especially if your stack contains different denominations.
  7. At this point, your password is well and truly gone. You might vaguely remember a few digits of your password, but no torture can force you to disclose it. Especially because of your policy of changing the password every time you started to remember it.
  8. (Optional) You don't have to actually do any of this. Your password can be your dog's name, as long as you're willing to stick to the story that you did steps 1-5, and maybe keep a stack of a few bills next to your computer.

You don't have to use cash, either; your password could be embedded in the order of the books on your bookshelf, or some other ephemeral thing that will most likely be destroyed by government agents in a search. But cash has the advantage of being much more likely to vanish completely in a search.

  • 16
    This sounds like a great way to lose your password forever, without the help of any would-be attackers. – David Grinberg Mar 6 '15 at 12:38
  • 1
    I like it. Although if this becomes commonplace, police searching the house will counter it by photographing everything they encounter during a search. – S.L. Barth Mar 6 '15 at 14:44
  • 31
    "Hey dude, I borrowed $20 from your drawer. Whoa! Why do you look so mad? Don't worry, I'll pay you back on Friday..." – Digital Chris Mar 6 '15 at 17:30
  • 2
    Clever! I like it. I have doubts about how well it would work however, at least in the U.S. where cash is not as likely to disappear, but end up preserved in an evidence locker. Then, even if they bills do end up out of order (and I agree that this is quite likely) once they get the scheme out of you, they still have a very limited set of candidate passwords to work with. Still, a neat idea. – Xander Mar 8 '15 at 23:31
  • 5
    +1 for thinking out of the box, but this would definitely need some optimizing before implementation. – Mast Mar 9 '15 at 9:07
27

He might be referring to neuroscientific methods of cryptographic primitives such as those outlined in the following paper: https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final25.pdf

Basically, you can prevent against "rubber hose attacks" as they call it (torture the password out of somebody) by training the user via some sort of game or app that subconsciously plants the password (combination of moves to accomplish a goal, for example) using implicit learning. The user can use the password, though cannot recall it outside of the situation of playing the game.

Think, for instance, moves you memorize in Pac-Man or Mario when you play the same level over and over... you get "good" at it because you are practicing the same movements repeatedly to accomplish the goal, even though if I sat you down with a game controller in an empty room (no game, no screen), you wouldn't (easily) be able to replicate the pattern.

I'm not sure if that is what Snowden is referring to, but it's one possibility.

  • 16
    Could you not be tortured to (1) reveal how you decrypt (playing the game) and then (2) be forced to play it? I suppose, under torture, you could argue that you can't play the game the same way due to the stress? – Alex Kuhl Mar 4 '15 at 16:30
  • 1
    The paper discusses that the user is not consciously aware that they have the password, nor might they even realize what the authentication mechanism is, especially under stress. Furthermore, check the "Basic Coercion Threat Model" section of that paper's Section 5.1 where they show the situation you describe as being impractical (for a 5-minute test it would take "about one year of nonstop testing per user which will either interfere with the user’s learned password rendering the user useless to the attacker, or alert security administrators.") – armani Mar 4 '15 at 16:42
  • 2
    The part you're citing does not solve the problem I mention. They define their "basic threat model" where an attacker intercepts some number of users, gets info out of them, and then tries to impersonate them at some physically secure location where an alarm is raised after a failed login attempt. The scenario here is different: the encryption is local to one computer and the attacker can force the actual user to play the game, no impersonation required. This is mentioned here arstechnica.com/security/2012/07/… and in the comments. – Alex Kuhl Mar 4 '15 at 19:11
  • 1
    @AlexKuhl, the game analogy is great (thanks Armani) but the key is not necessarily how you play the game but rather the game itself. For instance, I can demonstrate how to swim but I cannot explain (in significant detail) how I learned how to swim. The process of learning (or the game) is the key -or rather contains the key, because a user will subconsciously inherit the item being taught and it is that subconscious level where the 'password' is stored in your brain. Bare in mind that this paper is a mere conceptual approach and not necessarily a ready to implement design... – Matthew Peters Mar 4 '15 at 21:53
  • 1
    * imagines a game of "Missile Command" having to be played before being allowed to launch missiles at the enemy.. ironically you protect the cities too well and the enemy blows you up before you complete the game. – DoubleDouble Mar 5 '15 at 19:35
14

Keyfiles can almost accomplish this. The idea is the encryption key is stored as a file rather than a phrase the user memorizes. Keepass/KeepassX offers keyfiles as an option for securing the password database instead of a passphrase. The key can be more secure because it can be of much longer length than something a human needs to use, but the downside is that file must be protected from other parties gaining access. Typically these files are stored on a USB drive or other external media, or could possibly be held by a third party or otherwise outside your possession. This may not solve your problem though, since you may be tortured to reveal the location of the keyfile.

Other options are encryption that requires more than one person to be party during the process (again, could be tortured to reveal the other people involved), deniable encryption, and verifiable destruction. The latter two are discussed here. All of these have their own unique set of problems though.

  • +1. Your first paragraph gives a good introduction on how a license dongle works. – Mast Mar 9 '15 at 8:51
  • The keyfile on a separate physical medium does have the advantage that you can physically destroy it and thus be unable to recall it ever again. – jeteon Dec 14 '15 at 13:10
9

I haven't seen the documentary, but in addition to what others have spoke about, he could be talking about public/private key encryption.

You encrypt a file with the public key provided by an anonymous third party who shares your view. Only they can decrypt the file, and you don't know who they are.

So he has a document, encrypt it so it is protected and no matter how much you torture him he would never be able to decrypt it for you.

  • 3
    What stops them beating him with a rubber hose until he hands over the private key? – sapi Mar 4 '15 at 23:46
  • 7
    He need not have the private key. If I encrypt documents with a private key, store my only copy of the private key on a USB drive, and then give the drive to someone else... I no longer have the key. If Snowden did this, he would lose the ability to decrypt his documents, but that is a relatively small price to pay. Presumably, he already knows what is in the documents, and he stole them for others to decrypt. – James Mishra Mar 5 '15 at 0:19
  • 5
    Then you beat the person he gave it to with a rubber hose... – Wayne In Yak Mar 5 '15 at 2:04
  • 4
    Someone or someone's has the capability to de-crypt the files. All depends on how many people a person is willing to torture and how willing they are to stand up to the torture. – Wayne In Yak Mar 5 '15 at 20:32
  • 4
    @sapi Well, they can still beat me with a rubber hose but I don't have the private key. They can't beat Person A because neither I nor the government know who they are. They always contacted me. – David Jacobsen Mar 5 '15 at 20:56
5

While I haven't seen the film, I can easily imagine a randomly generated passcode which changes every [brief time window here]. Some online gaming security protocols started doing this a couple years ago, such as Battle.net (Blizzard - games like World of Warcraft, Starcraft, Diablo)

Add in the fact that you can only get the most recent passcode from a selected secure device and then he can't know what the current passcode is without that device.


Taking that and running with it...

As an extreme example, his phone may have encrypted files, but is not able to decrypt them without the passcode provided from the secure device [similar to @DavidJacobson's answer] - in this case a combination of people or computers in different locations [@JeffFerland's answer] which each have their own section of the passcode. If one person or computer is attacked, the others can be disconnected or moved - depending on the situation.

The weakest point is then the process for requesting the decrypt key. Assuming a person is qualified to have access to that file, they may have to provide physical identification. Perhaps they only have access to the decrypted file if they are in a specific location.

Sure, all this could ultimately be overcome, but the point is that it would be incredibly difficult. Let's say you capture someone with the file and try to get the key from them only to find out that it can only be gotten from someone else, and only while they are inside a guarded building, plus they can't physically take the information out with them. What would be your approach after that?

  • if you attack the building that requests are made from an alert will be sent out and the key will be unavailable.
  • You might be able to capture this other person (without it being noticed, since I assume they would have their access revoked if there is any reason to believe they are acting for another party) and "convince" them to go and steal or memorize the information, but can you trust that the information they bring back is correct?
  • You could try to attack the various holders of the key, but you would need to know all the people/locations and make it a simultaneous attack - otherwise the others would be better protected, moved, or, if that's not possible, maybe even just destroy the key. Of course, that could happen even during the attack.

In the end, I can't imagine the information that is on this file to make it worth so much effort. The more truly valuable the information is, the less people that will have access to it, and those people are likely in higher positions of power, therefore they are more likely to be protected or at least noticed missing if they get kidnapped.

4

There are very interesting answers there. One warning though: I was once offered to access the ATM of my bank account via a finger scan instead of the typical PIN. I refused. The bank was then assuring me that they guarantee that a copy of my fingerprint cannot be used (yeah, it was a few years ago)

I then told them that I am not sure that the bad guys know this and I very, very much prefer to rather give them the PIN than my thumb.

This is to say that the rubber hose users may not be aware of the subtle techniques used to not know the password.

  • Your life (or thumb, even) is worth more to you than the money the bad guys could steal using your ATM card. The data Mr. Snowden has access to may very well be worth protecting at the cost of his thumb, or even his life. This is not unheard of - take a look at Suicide pill on Wikipedia. – matega Mar 7 '15 at 17:00
  • @matega: I do not get your point. I am saying that the bad guys may beat the crap of you to get your password even though you assure tham that you do not know it, because you use a fancy mechanism and even have web links to prove that. – WoJ Mar 10 '15 at 7:31
1

I think the only way how you actually can decrypt it now, but not when being tortured is if you either have the chance to destroy/forget the key before you can be made to reveal it. Or the key has a property which makes it unusable in a tortured situation.

Many answers address only the part, where you "can not reveal the key to the evil guy, even if you wanted to" - but with some whistle-blower I think a usable system would also have to give you a way how to access the information if you need it, before or even after they got to you.

  1. Maybe you have a system where you can only enter the key if you are calm and relaxed. A sophisticated speech analysis software? Or maybe just an anonymous third party. - If only a third party has the key one scheme would be this: You have to post a video of yourself where you kindly request the key in a calm and controlled manner, standing in a public space or something. You post it somewhere where it gets a lot traffic like youtube/twitter. The anonymous source will access the video (among thousands of viewers) and if he believes you are safe and your voice sounds controlled and everything, he sends you the decrypted documents.

  2. Maybe the key self-destructs under certain circumstances, like physiological signs of extreme stress, like biting you teeth or extreme heart-rate. As soon as torture comes into play the key will be gone.

  3. There are shared key principles where you need a certain amount of people together to decrypt something - you could employ one, where you split the key in a way where you need at least 3 of 5 people to decrypt it. But then still, if you have a way to contact the other people of this group, you can probably be forced to contact them, so it all boils down to solution 1, where your communication with them needs to be good enough, so they can make sure if you are forced to do it or do it willingly.

  • Another possibility but more akin to scifi would be mental conditioning: Maybe you could condition your brain to forget the key in a traumatic event, like repressed memories which can only be revealed in a certain calm and relaxing environment... – Falco Mar 9 '15 at 16:43
-1

It might refer to having multiple possible decryption states. Basically, you start with an extra-large blob of encrypted data, and multiple keys. Each key results in a different document.

Obviously, the encrypted data needs to be large enough to hold all documents, but there's no way to prove how many keys exist. Make it large enough to hold 10 documents, for example, and you could have 2 false keys, one real key, and a bunch of random data.

  • 2
    This doesn't address the issue of how Snowden cannot decrypt the documents. If he doesn't know the "correct" key, there is no need for a bunch of other keys. – Matthew Read Mar 5 '15 at 2:09
  • An encryption algorithm that produces multiple coherent outputs from the same ciphertext when different decryption keys are used is still very much in the realm of theory, not practice. – Mark Mar 5 '15 at 5:19
  • @Mark: Any particular part of the ciphertext blob only needs to represent one file. If one has nine plausible fake documents and a real one, have a program "flip a coin" for each fake document and either replace it with random data or not. Then encrypt each of the ten documents with a different key and store them in random order. The number of documents that could be decrypted using all ten real keys would be somewhere between one and ten, but it would be impossible to tell whether any supposed set of keys was complete. – supercat Mar 6 '15 at 23:44
-3

I'm going a little sci-fi with this answer.

Smart cards, even contactless ones are powerful enough to do cryptography. They often contain a private key, which was generated by them and never leaves the card, but the corresponding public key can be retrieved freely. These smart cards can be protected with a password, they can make themselves inoperable after 3 failed tries, etc. They are uncloneable and extremely secure. (Also, they are tiny, they're a tiny chip within a plastic card, and they consume only a tiny amount of energy.)

You could then encrypt a document, a whole hard drive or whatever using a random key, then encrypt the key with the smart card's public key and save only that. This way, if you want access to the encrypted data, you first have to ask the smart card to decrypt the key using its internal private key.

Now we just have to tie the card to Snowden in a way that ensures that

  • It is only him that can activate the card
  • The card self-destructs when it is not with him any more
  • He himself is able to disable the card permanently, even when restrained

A straightforward option is implanting the card (only the chip, not the plastic part) into him. It could feed on the voltage generated by his body while inactive (e.g. his heart and/or muscles output a few millivolts constantly) and disable itself if this power is cut. You could also wire it up to some of his voluntary muscles which, if activated in a certain pattern could enable or destroy the card. If we want to go deeper into this sci-fi, you could have the card check if his heart rate and/or epinephrine level is below a certain threshold and deny operation temporarily when he is under excessive stress. It would have an antenna in a convenient place, possibly his palm, to communicate using NFC or something similar.

If the power supplied by his body isn't enough, another option would be to implant it along with a battery. It could be a pacemaker-like device. Pacemakers have an internal battery which lasts for years. It could do anything the previously described implant does. (It could be a pacemaker/ICD too, for preventive purposes - It's not unheard of for important people to have a defibrillator in their home and their family trained to use it.) An alternative idea would be to have a regular contactless smart card in his front pocket that feeds off of this pacemaker-like device continuously using the same principle as NFC and disables itself permanently if power is cut for more than a minute. This NFC power could also carry cryptographical data to be unique and unreplicable.

  • Do you have any citations to point towards, which would indicate that what you are describing is possible and practical to do, for an individual? – a CVn Mar 7 '15 at 20:02
  • There's this for an example. It is a contactless smart card, running solely off the power it receives through NFC. Low-power ECG and EMG (electromyograph) devices do exist. A Low-power ECG analyzer is used in every implantable pacemaker - an EMG version could be made too, as voluntary muscles give off of electric signals similar in amplitude to those of the heart. Of course, it requires specialised hardware which an individual does not have access to. Which part of my answer do you object to? – matega Mar 7 '15 at 21:26
  • My objection is mostly with your answer in relation to Snowden's talking about himself. The way he phrases himself makes it sound like his actions to protect the confidentiality of the data, while sophisticated, is something that should be available to an individual even outside of the purview of a large organization. I don't really see how your proposal qualifies as such. – a CVn Mar 8 '15 at 14:08

protected by Xander Mar 6 '15 at 18:01

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.