5th AMENDMENT & DECRYPTION
from: john.nieder@f33.n125.z1.fidonet.org
In a recent message, Murdering Thug said: | The Fifth Ammendment is the tastiest one of all when it comes to | encryption. By pleading the Fifth, you do not have to decrypt anything | for the prosecution. The Fifth Ammendment gives you the right not to | testify or provide evidence that would incriminate you. Providing a | key to decrypt your hard disk would incriminate you, and you don't | have to do it.
I should like to see the body of case law on which this opinion is based, if any. . Recently this question came up in another forum on encryption & an "authority" on communications law claimed the probable scenario would be that the arresting agency would have the encrypted material decrypted by a competent government or academic agency & the costs of said decryption would eventually be recovered from the defendant through civil suits, presuming the defendant had sufficient assets. It is my memory of the thread that he claimed this had been done in previous cases. JN ... Gun control: It ain't about guns, it's about *control*. --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder@f33.n125.z1.FIDONET.ORG
from: john.nieder@f33.n125.z1.fidonet.org
(commenting on the strategy of "taking the 5th" on the matter of decrypting one's files)
. Recently this question came up in another forum on encryption & an "authority" on communications law claimed the probable scenario would be that the arresting agency would have the encrypted material decrypted by a competent government or academic agency & the costs of said decryption would eventually be recovered from the defendant through civil suits, presuming the defendant had sufficient assets. It is my memory of the thread that he claimed this had been done in previous cases.
With strong crypto, e.g., with 300 decimal digit moduli, the "costs" of decryption by brute force could easily exceed the GNP/GDP of the U.S. So taking the 5th, or claiming to have "forgotten" the key, should work, all other things being equal. But all other things are not equal...perhaps they eavesdropped as the private key was being typed in (and it was stored somewhere, presumably), perhaps they "black bagged" the house, perhaps a simple pass phrase was used in lieu of memorizing 300 digits, and so on. A lot of work lies ahead. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: waiting for the dust to settle.
tcmay@netcom.com writes:
from: john.nieder@f33.n125.z1.fidonet.org
(commenting on the strategy of "taking the 5th" on the matter of decrypting one's files)
. Recently this question came up in another forum on encryption & an "authority" on communications law claimed the probable scenario would be that the arresting agency would have the encrypted material decrypted by a competent government or academic agency & the costs of said decryption would eventually be recovered from the defendant through civil suits, presuming the defendant had sufficient assets. It is my memory of the thread that he claimed this had been done in previous cases.
With strong crypto, e.g., with 300 decimal digit moduli, the "costs" of decryption by brute force could easily exceed the GNP/GDP of the U.S.
Since none of us have ever been inside the NSA, we cannot underestimate their power and resources. For all we know they may have 500 Intel Delta supercomputers linked together, each having 65,536 i860-XP/50mhz chips. We really don't know what kind of iron they possess. Thus we can't assume that they can't factor extremely large numbers easily. The only way to thwart the NSA is to use an encryption scheme which has been _proven_ uncrackable. The only one I know of is the One Time Pad. A person I know is working on a computerized version of the OTP that extracts a truly random stream of bits from TV/RF static and massages it using a DSP to be highly variable (e.g.: no runs of 0's or 1's longer than 5 bits). This stream is then XOR'd in one time pad fashion with an LZW compressed version of a plaintext message. The key stream is never re-used and after a byte from the key stream is used, it is erased (crossed off the digital pad). Since no bit in the key stream has any known relationship to any other bit (unlike in pseudo-random-number generators), the goal of extracting either the key or the plain text is intractable. If the NSA can crack the OTP, then they must have God himself on their salary. Read the sci.crypt FAQ on more info about the one time pad. The only problem with the whole OTP scheme is that it can only be used for provably secure communications over unsecure channels. It is much more difficult to use a OTP to encrypt one's hard disk without having to memorize 50 million bits of TV/RF static. Then again 50 million bits of TV/RF static can be stored on a totally-self-destructing memory device. For instance a memory card with battary backed RAM that fits in my pocket. If the law busts in, I merely have to pull out the lithium battary from the card and the key is destroyed beyond all possible recovery. If the NSA can extract bits from the proverbial bit bucket in the sky (also known as write once memory (WOM)), then they truly must have God working on their side. Thug
Murdering Thug (not his real name) writes, quoting me:
With strong crypto, e.g., with 300 decimal digit moduli, the "costs" of decryption by brute force could easily exceed the GNP/GDP of the U.S.
Since none of us have ever been inside the NSA, we cannot underestimate their power and resources. For all we know they may have 500 Intel Delta supercomputers linked together, each having 65,536 i860-XP/50mhz chips. We really don't know what kind of iron they possess. Thus we can't assume that they can't factor extremely large numbers easily.
Doubtful. That's why I cited 300 decimal digit moduli...the current factoring record is, I believe, a 105 digit number, and this took a network of Sun workstations a year or so (this was big news some months back). As a former Intel employee and current Intel stockholder (yeah!), I certainly hope the NSA is consuming large numbers of Touchstone Deltas, but they won't do much good against strong crypto. A bigger effect would be a breakthrough in factoring. No evidence of this, though.
The only way to thwart the NSA is to use an encryption scheme which has been _proven_ uncrackable. The only one I know of is the One Time Pad. A person I know is working on a computerized version of the OTP that ....rest elided...
Sure, one-time pads are information-theoretically secure. The problem is the key distribution problem, as well as the storage of one-time pads. For example, for the couple of hundred folks on this list to communicate securely will other members, each would have to meet in person or deliver by trusted courier a one-time pad to _each_ of the others! A very tough logistical problem, fraught with potential weaknesses, and much easier to spoof or break than, for example, factoring very large numbers. This is the problem, the key distribution problem, that public key methods solve. -Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: waiting for the dust to settle.
tcmay@netcom.com writes:
Sure, one-time pads are information-theoretically secure.
The problem is the key distribution problem, as well as the storage of one-time pads. For example, for the couple of hundred folks on this list to communicate securely will other members, each would have to meet in person or deliver by trusted courier a one-time pad to _each_ of the others! A very tough logistical problem, fraught with potential weaknesses, and much easier to spoof or break than, for example, factoring very large numbers.
This is the problem, the key distribution problem, that public key methods solve.
I never recommended the digital OTP as a replacement for public key cryptography. Clearly the logistics of using OTPs on a large scale are clearly dismal. While public key solutions like PGP are good for mass communication systems, they are not secure as far as I am concerned. I am sure the NSA has plenty of tricks up their sleeve for dealing with PGP & RSA. OTP is an excellent solution for small groups (5 people or less) who MUST have completely secure communications. It would be quite easy for a small group like this to physically meet once a year and exchange their fresh 250mb pads (stored on magnetic reel tape which is incrementaly shreaded & burned on the way out of a OTP decoding machine). In fact only one trusted individual is needed to operate an OTP pad generating machine to create the fresh pad tapes from RF noise and only once a year. This could be the ring leader of the group and tape distributor. A 250mb pad is enough for each individual to send 250,000 one kilobyte messages to his conspirators, surely enough pad material to require physical pad exchange only once a year, perhaps even less frequently. A terrorist group or drug ring could use OTPs quite easily from a logistical and key distribution point of view and never have to worry about their messages (e-mail or telex) being decrypted by any agency on the face of the earth. The costs of such a method are minimal for a group of 5 terrorists, a 5-node system like this could be built and set up for around $5000. Of course an OTP scheme must insure physical security as well. Used up key stream tape must be incrementally shredded and burned beyond recovery. And plaintext messages should be displayed to CRT, never be stored. After each message is read or sent, it is destroyed by being overwritten in RAM by nulls. The screen should either by an LCD display or a Tempest proof CRT. Unused pad tape must be quickly removable so that it can be dropped into a near by barrel of sulfuric acid should the law bust through your door. This would prevent the capture of the unused pad tape and prevent the law from spoofing your conspirators by sending and decoding messages as you. A ventilation system must be put in place to suck out the fumes from the barrel of acid out of the room. A wireless alarm system must be in place to allow the detection of a law enforcement assault and allow the quick acid bath destruction of unused pad material. Note, this scheme comes directly from my mind as I speak and does not fly out of anything. It could be refined into a very secure and inexpensive set up. A well implemented OTP scheme makes the interception of plaintext impossible and the capture of messages by physical raids also impossible. This is what I believe to be the only provably secure communication method. If I was a drug king pin, this is what I would use. Thug
participants (3)
-
John.Nieder＠f33.n125.z1.FIDONET.ORG -
tcmay＠netcom.com -
thug＠phantom.com