8 ms·

Would I be right in suggesting that it's not encrypted data unless someone can decrypt it to prove so? In other words, we're free to send garbled nonsense to e

Would I be right in suggesting that it's not encrypted data unless someone can decrypt it to prove so? In other words, we're free to send garbled nonsense to each other.

DanBC 12y ago
I'd think not. England will imprison people who forget passwords. Here are two examples: http://bbc.co.uk/news/uk-25745989 http://bbc.co.uk/news/uk-25745989 http://www.theregister.co.uk/2009/11/24/ripa_jfl/ http://www.theregister.co.uk/2009/11/24/ripa_jfl/
- subliminalpanda 12y ago
  Does this also include using something like ephemeral keys?
  - AlyssaRowan 12y ago
    To my (lay!) knowledge, no. The primary legislation indicates that to be in violation of that section the court has to believe you did have a way, when you were given an order under RIPA, to make the content they're seeking readable, and you haven't done so. If you do not possess a means to make it readable at that point because you routinely use ephemeral keys - as most people do now (specific example: ECDHE TLS ciphersuites) - you wouldn't be in violation of RIPA in that case, I believe. Also, keys which are only used for signing are specifically exempted from disclosure in the primary legislation - so don't hand over private TLS signing keys (if, and only if, you always use ephemeral keys, not static RSA) or any GnuPG/PGP signing keys (encryption subkeys on the other hand? However, GnuPG has a way to output the symmetric keys for individual messages, allowing you to limit the damage)! Of course, if ever presented with any such order, you absolutely need very good legal advice rather than taking it from a lay random on Hacker News. I would definitely encourage you to fight, if you can.
    - subliminalpanda 12y ago
      That's good to know, I appreciate the advice.
- disputin 12y ago
  I was thinking something less obviously encrypted than a usb stick with a dialog box saying "Enter password" - how about steganography? "A password for my image?"
nacnud 12y ago
It depends where you live. In some countries you are required to disclose an encryption key when required to do so by law enforcement: http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd... .. and if there is no key then you may be in a very difficult position.
- Lawtonfogle 12y ago
  I've rar'd quite a few files in my day, many with a password. The majority of them I could not remember if asked. We effectively have made forgetting a crime in the name of protecting children and stopping terrorism.
  - vixen99 12y ago
    And it won't do either, merely encourage the use of other routes to planning such activities. It's not difficult to imagine a terrorist plan that has no dependence on electronic messaging. Talk about selling your birthright for a mess of potage.
- ominous 12y ago
  Civilization should have collapsed the moment a large group of people agreed that one element should disclose a specific piece of knowledge, or face punishment. If everything else if my life fails, I want to become a martyr to this cause.
  - PJDK 12y ago
    You'll find it rather difficult to enforce a tax code with that attitude.
- seanp2k2 12y ago
  See also: http://en.m.wikipedia.org/wiki/Deniable_encryption http://en.m.wikipedia.org/wiki/Deniable_encryption
  - 12y ago

Would I be right in suggesting that it's not encrypted data unless someone can decrypt it to prove so? In other words, we're free to send garbled nonsense to each other.

DanBC 12y ago

I'd think not. England will imprison people who forget passwords. Here are two examples: http://bbc.co.uk/news/uk-25745989 http://bbc.co.uk/news/uk-25745989 http://www.theregister.co.uk/2009/11/24/ripa_jfl/ http://www.theregister.co.uk/2009/11/24/ripa_jfl/

subliminalpanda 12y ago
Does this also include using something like ephemeral keys?
- AlyssaRowan 12y ago
  To my (lay!) knowledge, no. The primary legislation indicates that to be in violation of that section the court has to believe you did have a way, when you were given an order under RIPA, to make the content they're seeking readable, and you haven't done so. If you do not possess a means to make it readable at that point because you routinely use ephemeral keys - as most people do now (specific example: ECDHE TLS ciphersuites) - you wouldn't be in violation of RIPA in that case, I believe. Also, keys which are only used for signing are specifically exempted from disclosure in the primary legislation - so don't hand over private TLS signing keys (if, and only if, you always use ephemeral keys, not static RSA) or any GnuPG/PGP signing keys (encryption subkeys on the other hand? However, GnuPG has a way to output the symmetric keys for individual messages, allowing you to limit the damage)! Of course, if ever presented with any such order, you absolutely need very good legal advice rather than taking it from a lay random on Hacker News. I would definitely encourage you to fight, if you can.
  - subliminalpanda 12y ago
    That's good to know, I appreciate the advice.
disputin 12y ago
I was thinking something less obviously encrypted than a usb stick with a dialog box saying "Enter password" - how about steganography? "A password for my image?"

nacnud 12y ago

It depends where you live. In some countries you are required to disclose an encryption key when required to do so by law enforcement: http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom http://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingd... .. and if there is no key then you may be in a very difficult position.

Lawtonfogle 12y ago
I've rar'd quite a few files in my day, many with a password. The majority of them I could not remember if asked. We effectively have made forgetting a crime in the name of protecting children and stopping terrorism.
- vixen99 12y ago
  And it won't do either, merely encourage the use of other routes to planning such activities. It's not difficult to imagine a terrorist plan that has no dependence on electronic messaging. Talk about selling your birthright for a mess of potage.
ominous 12y ago
Civilization should have collapsed the moment a large group of people agreed that one element should disclose a specific piece of knowledge, or face punishment. If everything else if my life fails, I want to become a martyr to this cause.
- PJDK 12y ago
  You'll find it rather difficult to enforce a tax code with that attitude.
seanp2k2 12y ago
See also: http://en.m.wikipedia.org/wiki/Deniable_encryption http://en.m.wikipedia.org/wiki/Deniable_encryption
- 12y ago