5
$\begingroup$

I'm the chief security officer of a major (fictional) cell phone manufacturer, and after two months of not being able to unlock the San Bernardino shooters' cell phones, the spooks are getting fed up and demanding that for my next generation of cell phone models, I include some mechanism by which they can access the encrypted information held inside a terrorist's recovered cell phone. They say that if I don't make this work, they'll have me fired and replaced with someone who will... but the classic solution (install a software back door that is activated by a secret password/technique that only the government knows about) is a non-starter for me, because it's become obvious that the government isn't much better at keeping secrets than anyone else, and it would just be a matter of time before all the world's baddies knew the secret password/technique also, at which point my customers would be very unhappy with me.

What I'd like to implement instead is a mechanism that will still be secure even if everyone in the world knows all its details, because only a very well-funded major government would have access to the physical resources necessary to perform the unlocking operation. As a (not very well thought out) example, the phone might unlock itself if it detects that it has been floating in zero gravity for more than an hour, on the theory that only a major government could afford to place the phone into orbit.

Is there any practical way to implement this (that doesn't involve launching critical evidence into orbit)?

Improve this question
$\endgroup$
16
  • 3
    $\begingroup$ This appears to be a question about a single plot point--a gov't-only backdoor--rather than about worldbuilding within the scope defined in help center. $\endgroup$
    – nitsua60
    Feb 11, 2016 at 4:13
  • $\begingroup$ Well, I know what major scandal I'm uncovering. $\endgroup$
    – Xandar The Zenon
    Feb 11, 2016 at 4:42
  • 1
    $\begingroup$ @nitsua60 I don't know, this question could easily be taken to mean how the company would do it, after all, the company is the one that builds the phones. $\endgroup$
    – Xandar The Zenon
    Feb 11, 2016 at 4:52
  • 3
    $\begingroup$ How would you arrange that only the correct government could afford to implement the unlock? $\endgroup$
    – sh1
    Feb 11, 2016 at 4:57
  • 1
    $\begingroup$ if you don't need to decrypt any encrypted files, but to unlock that phone, place some kind of disguised rifd-chip inside, that will unlock if it get the correct 4096 bit private key transmitted on a gov-only frequency created by a device you only sell three times... thats not perfect, but may work somehow. So... still, that kind of question seems to be better for a conspiracy.stackexchange if there is one. But hey, you can get an answer for "how deep in the water you have to be to survive a nuke going off over the surface", so this questions feels legit. $\endgroup$
    – Confused Merlin
    Feb 11, 2016 at 6:01

12 Answers 12

Reset to default
5
$\begingroup$

Let it depend on a many keys, not one

I believe you could construct such an unlocking mechanism, tailored for a specific government. It must not rely on a single key, but on the combination of several one-time keys issued to the members of some legislative or executive body. (Parliament/supreme court /etc)

The phone will only unlock given the keys representing a majority of that body. Naturally the identity of the representatives thus voting for an unlock will be logged, making them accountable.

This way the "government" you trust is not some secret three letter organisation but the actual, accountable, formal government.

Of course this is not completely safe. Human error plays in etc (but that can be part of your plot)

However to abuse this back door you will need either a coordinated effort by several chosen representatives or to somehow gain illicit access to a large number of personal master keys (as opposed to one).

Point being: a system that uses the checks and balances used in a (democratic) government.

Improve this answer
$\endgroup$
5
  • 1
    $\begingroup$ en.wikipedia.org/wiki/Secret_sharing $\endgroup$
    – PyRulez
    Feb 12, 2016 at 23:34
  • $\begingroup$ This answer likely means "signature key" rather than "one-time key". The gist would be that a bunch of government authorities could have crypto signatures that official systems would check for; then, if an order's to be issued requiring multiple signatures, they each merely have to sign that order (which includes a time stamp and GUID to prevent replay attacks) to assert that they authorize it. Then, a verifying system would check that the requisite number of signatures are valid before accepting the order. $\endgroup$
    – Nat
    Apr 28, 2017 at 13:39
  • $\begingroup$ The problem with this approach is that an attacker who has physical access to the device can rig the authorization mechanism to merely report that any action is authorized, completely compromising any system that the attacker can modify. For example, if a cell phone is set to decrypt in response to a signed order from verified government officials, anyone who steals that phone could trick it into thinking that it's received such an order by modifying the circuit to report that verification was successful, without any need for actual verification. $\endgroup$
    – Nat
    Apr 28, 2017 at 13:41
  • $\begingroup$ This approach can be valid if the system's physical security isn't an issue. For example, this sort of approach can work to verify orders from government officials to secure servers on a military base, assuming that no one's able to tamper with them. $\endgroup$
    – Nat
    Apr 28, 2017 at 13:45
  • $\begingroup$ Yes, in the end it's all about "who do you trust?". If the manufacturer of the device or the supplier of the authentication services used cannot be trusted (ill intent or negligence) the device is not secure. $\endgroup$
    – Guran
    May 2, 2017 at 7:40
7
$\begingroup$

There is no way... almost

I'd say the original goal - design a smartphone with a universal built-in decryption mechanism - is impossible to achieve. Encryption strength depends on the algorithm and the data, not the media. So it's about software, not hardware. You can't make a phone, or a flash drive, or a DVD drive that allows you to do that, since it doesn't depend on media. However, there are several options:

Option 1 - continuous logging

Assuming the phone itself was being used for decryption at least once, when you have the phone and the encrypted data inside but don't have the key, the only thing that could help you is a logging system.

If a phone logs all the actions it's doing, it could help to recover the data. However, that means a lot of debugging information (dumps, logs) being transmitted or recorded all the time - not very plausible scenario that terrorists won't notice anything.

Option 2 - using only government approved software

There are algorithms allowing you to decrypt data using some kind of "master" (or, say, "recovery") key. These algorithms are used in enterprise solutions. The "recovery" key must to be used beforehand, in order to generate a keypair.

All you need to do is to force end-point customers to use the one and only encryption software. So yes - technically it IS possible, still not very feasible though.

But all this won't work

Let's assume there is a smartphone design, that actually allow the government to decrypt all the data inside the phone. Let's believe, that the government forced all of its citizens to change their phones to the new one. Let's dream, that all other phones (including foreign ones) were destroyed or don't work anymore.

Will terrorist use that phone to store sensitive information? The phone from your example was used just because it was secure. If not, a plotter could use any other device (say, a laptop) for encrypting and storing their info, keeping the phone for communications only.

Improve this answer
$\endgroup$
4
$\begingroup$

No way, and not for a technical reasons

But for human ones. Government is but a set of humans. Nothing more, not really. So some humans have a backdoor. After some time the same humans are not a government. But they have knowledge. If there is a device to dispense one-time codes, they can get hundred of keys with them. They can get a plans and RNG seed. They can ask their successors for access. While still in government, they can sell access. It might be tempting. Or they can hire you to debug a glitch in the system, and then you have access. And so on.

No thing about government would prevent leak of access. And if you can design and manufacture once, you can repeat it.

Improve this answer
$\endgroup$
3
$\begingroup$

The NSA has to have much more computing power then anyone else (probably true today), cyphers with short key length can be secure against anyone else but not the NSA (this is thought to be why the DES key length was lowered from 64 bits to 56 bits, 256 times less secure). Since hardware computing power doubles every 18 months, the NSA would have to be far ahead to keep up. One way they could really be far ahead is with quantum computing.

An alternative approach is to make a back-door that depends on chips that do not release the keys inside, they are embedded in hardware with a self-destruct mechanism to prevent access to decryption keys.

Improve this answer
$\endgroup$
2
  • 2
    $\begingroup$ The original IBM Lucifer cipher (which DES is based on) used a 112 bit key spread out to 128 bits (112 key plus 16 parity bits). DES uses a 56 bit key spread out to 64 bits (56 key plus 8 parity bits). Interestingly enough, it turns out that with the NSA changes, DES is resistant to differential cryptanalysis (which was not known in the public litterature of the time) and it actually offers roughly its key length of real security, as evidenced by the fact that even as of recently, the best publicly known non-brute-force attack needs 64TB of known plaintext and up to 2^43 time (cryptions). $\endgroup$
    – user
    Feb 11, 2016 at 14:16
  • $\begingroup$ I don't think DES keys are any shorter due to the government's involvement. $\endgroup$
    – JDługosz
    Feb 11, 2016 at 16:03
2
$\begingroup$

Short answer
You cannot.

Long answer
Since what you are looking for is a key escrow mechanism, the problem is that there is no way to build a backdoor that enable the good guys to access and the bad guys to stay locked out. Every technical solution you implement had the weakest point in the humans. Even a scenario like the one suggested from @ConfusedMerlin in the comments has the problem that the key can be stolen/sold. After all, how can be sure that the key is used from the right guy ?

Anyway, XKCD has already the solution

Improve this answer
$\endgroup$
3
  • $\begingroup$ I think your objection applies only to keys that consist solely of information. As a counterexample, imagine that the "key" was the detonation of a nuclear weapon -- i.e. if a tamper-proof detector inside the phone detects a sufficiently high EMP pulse, it unlocks. This would be secure against non-government hackers, so long as the ability to detonate nuclear weapons is available only to governments. (.... and if non-government people are going around detonating nuclear weapons, then you've got bigger problems to worry about) $\endgroup$
    – Jeremy Friesner
    Feb 11, 2016 at 15:34
  • $\begingroup$ Oh, well, not really. An EMP can be generated also without a nuclear weapon, google for "EMP generator". And I suppose that also non-government hacker can build one of them powerful enough. Beside this, detonating a nuke will also destroy the device you are trying to access, it does not look like a good idea. $\endgroup$
    – Gianluca
    Feb 11, 2016 at 15:50
  • $\begingroup$ You can't make a tamper-proof detector. Someone wants to steal information from random phones? They just remove the detector entirely, start sending combinations of signals down whatever wires were connected to the detector, fry a few phones figuring out what each wire is for, then once they've got the code, they can unlock every phone ever made by this manufacturer in like 3 seconds. $\endgroup$
    – MichaelS
    Feb 12, 2016 at 10:07
2
$\begingroup$

Use slightly weak encryption

Liaise with that three-letter agency. Find a crypto algorithm which the government's resources can break by brute force in about a day. This means that most bad guys simply won't have access to the means, and rarely any profit motive to try. The exceptions would be the largest corporations who manufacture computer hardware, but in almost all cases the threat of criminal prosecution and huge fines will deter them.

If IT hardware continues to advance roll our a software upgrade that slightly hardens the encryption so as to restore the agreed difficulty.

There will be a problem in that the government will press for weaker crypto that is cheaper to break. You'll need to convince them of the economic harm to the nation that will follow from criminals gaining an economic incentive to break the crypto. Ultimately since the government makes the laws it holds the whip hand. If you lose this argument your business us doomed, but if the government just banned all but trivial crypto it's doomed faster.

If a deal is done then it's nature could be informally leaked. Yes, the government can crack your phone if it really really wants to. It will cost tens of millions for your spouse, your enemies, your business rivals, criminals, journalists etc. to even try, so mostly they won't.

Improve this answer
$\endgroup$
3
  • $\begingroup$ This is not a backdoor. And you leave your crypto algorithm open to everyone can gather enough computing power, which can be not only your government, think botnet. And if I simply layer two time the algorithm, with two different password, you have a big problem. $\endgroup$
    – Gianluca
    Feb 12, 2016 at 10:56
  • $\begingroup$ @Gianluca agreed it's very far from perfect. But the question was how to save the company. Any backdoor will fail. Once it becomes known to the bad guys there is no security left at all. A lock that requires government-scale resources to pick is, IMO, a better idea. At least it does not collapse from hero to zero overnight and take the company with it! $\endgroup$
    – nigel222
    Feb 12, 2016 at 20:01
  • $\begingroup$ IMO, the idea has too many drawbacks to perform reliably in the real world. And still I'm afraid that the idea is way weaker then it looks. $\endgroup$
    – Gianluca
    Feb 12, 2016 at 20:56
1
$\begingroup$

Make your key out of something weird

We use lots of different parts of the electromagnetic frequency for communication. I suggest you either build your new gizmo to communicate over a part of the EM spectrum that is difficult to produce/modulate/receive or perhaps by using a small enough modulation that only a well funded government could detect it.

The answer could be radioactive materials. Certain elements in existence are not found naturally on earth, and have only been created through human processes (i.e. fission). So your phones could have a gamma ray detector that decrypt the data store in the presence of an encoded signal from one of these materials. Would-be hackers would need to steal your private key, some highly controlled substance only produced in nuclear reactors, and a way of modulating the signal.

You could advance the idea further into sci-fi by creating a quantum key out of such rare particles. Some atoms can only be produced in lab conditions and live for fractions of a second. You could produce some of these particles and control their spin, encoding your private key into the particle states.

The second idea was around high accuracy modulation. A topical example of this is gravitational waves. Detecting such waves requires incredible equipment (4km long lasers). An anaology would be the first person to ever invent a lens - he could write so small that only he, with a magnifiying lens could read what he had written.

The first example was having a key that is really really hard to produce, even if you know what the code is. In this case I assume the phone has a detector than can easily read the key. In this second example (of high accuracy modulation), the key is really really hard to read and I doubt the phone could be given such capabilities. So I think the phone would need to transmit a public key (which would change regularly), your spook-types communicate back with the public key and then they exchange a symmetric key to encrypt further communications.

Basically, it makes more sense to have a key that's really hard to make. If its really hard to read the key, rather than make it, it makes the transaction a bit more difficult.

Improve this answer
$\endgroup$
1
$\begingroup$

Key Strengthening or Weakening

A recovery key is created but not given to anyone (the phone keeps the public key, and tosses the private key). The NSA can crack it in a reasonable length of time, but only that unique dedicated hardware can do so.

A public/private key algorithm and size is chosen so that cracking it is in reach only for the NSA’s special computer. On a programmed schedule it adds bits to the effective key size, to keep pace with Moore's Law.

Details: a public key is in memory so we need asymmetric encryption. It creates a random session key for data, and encrpts that with the normal user’s key, the designated recovery key for company-owned phones, etc. and the NSA weak key is added to the list. Those encrypted keys are stored with the data block.

Of course, it could just use the weakened key for the normal uses and ot need a separate government key. But, this additional key could be hidden away so it might not be noticed by others examining the encrypted data format. But if (when) it is discovered, only the NSA can crack it in a reasonable length of time, and only on their dedicated system for that.

Improve this answer
$\endgroup$
0
$\begingroup$

Zero G won't work

The 0g mechanism you designed would not be secure. All an attacker would have to do is open up the phone and replace the accelerometer that can detect acceleration, with a device that behaves electronically like an accelerometer in 0g.

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ There are already components in an iPhone that are designed to be secure against tampering -- i.e. that make it very difficult or impossible to remove of replace them without bricking the phone. I believe that in principal, at least, a secure accelerometer could be included, which would be very difficult to remove or replace without detection (but that the 0g mechanism would be impractical for other reasons, mainly that the government would not be willing to launch its only copy of important evidence into space on a rocket that might explode during launch) $\endgroup$
    – Jeremy Friesner
    Feb 11, 2016 at 15:25
0
$\begingroup$

Another answer

Short of detecting that it is in orbit have the phone unlock itself if its GPS detects that it is at (a) particular location(s) agreed with the government. That location is militarily secure. Maybe inside the location where they assemble nuclear warheads? Should be about as secure as possible. Or at 3000 ft. above such a location and moving at 10mph, which requires being in a helicopter in some very well defended airspace.

Only question is how easily can GPS satellite transmissions be spoofed?

Improve this answer
$\endgroup$
1
0
$\begingroup$

A simple answer: Use a Software Protection Dongle. It's basically just a electronic storage device that has some cryptographic key in it. When the phone sees this key, it'll open up (or do whatever the government wants it to do). If you use secure cryptographic techniques (that update with the state-of-the-art) you can ensure the phone is secure.

Everyone can know there is a key, and even what cryptographic algorithm was used, but they can't figure out what the key is without government-level computing power. (Or even with government-level computing power, if you want)

Improve this answer
$\endgroup$
1
  • $\begingroup$ The problem is that someone might get his hands on the key, and would then have access to every phone. The government is constituted of humans, and so loosing a key is not out of question. $\endgroup$
    – satibel
    Apr 4, 2017 at 12:53
0
$\begingroup$

It seems plausible

I actually wanted to answer that such a thing is simply possible, but to be sure one either has to find or design a protocol and I do not have time or skill to do either. I will however sketch what this could look like.

First of all elliptic curve cryptography is a kind of cryptography that is currently widely used in practice. As such it is a tested method. The idea is that people can exchange passwords with one another without an eavesdropper finding out what the exchanged password is.

Now there are many different elliptic curves and for an elliptic curve protocol only one elliptic curve has to be chosen. This choice is important because some of the curves are essentially flawed and using them would be insecure.

It is however plausible that an elliptic curve can be constructed that is flawed in such a way that only the constructor can exploit the flaw. (e.g. The constructor might now the number of points on the curve or even the prime factorization of this number.) Exploiting this the constructor could be able to decrypt anything that was encrypted using this curve.

In your situation the government (or a department thereof) should construct such a protocol and issue that to the phone companies. As long as they keep the exact details of the exploit to themselves they will be able to eavesdrop on anyone.

Note1: This does mean that the government can be completely open about what they are doing. Since to actually use the backdoor you need the secret key that only the government has.

Note2: Great care should be given to keeping this secret key, really secret. This is however not impossible.

Note3: This is of course not perfect. Terrorist might simply decide communicate using a secret code of their own. But this is more or less the same as not using phones anymore.

Edit: I just re-read your post and noted that you did not want to let this rely on the government keeping things secret. This is still possible in a way. What can be done is embedding the final key in one unique object in a way that it can be used, but not recovered. So there is one physical device that can decrypt everything.

Improve this answer
$\endgroup$
5
  • $\begingroup$ It seems the flawed-elliptic-curve technique has been done, and the flaw was later discovered, and software including that backdoor is now likely vulnerable to hackers ... blog.cloudflare.com/… $\endgroup$
    – Jeremy Friesner
    Feb 11, 2016 at 15:39
  • $\begingroup$ The number of curves, in a finite field, is finite (not infinite). $\endgroup$
    – JDługosz
    Feb 11, 2016 at 16:05
  • $\begingroup$ @jeremy. The flaw can be known but computationally to hard to solve with our computation power. $\endgroup$
    – Heijne
    Feb 11, 2016 at 16:25
  • $\begingroup$ The number of curves on a particular finite field is indeed finite. There are however an infinite number of finite fields over each of them there are elliptic curves. That given an infinite number of curves. $\endgroup$
    – Heijne
    Feb 11, 2016 at 16:28
  • $\begingroup$ This is actually similar to option 2 of enkryptor. $\endgroup$
    – Heijne
    Feb 11, 2016 at 16:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .