When is a Lock, Not a Lock?

January was an interesting month for cryptography. The UK Prime Minister made some very strong statements about digital communication, essentially calling for strong encryption to be shirked by providing law enforcement with a back door. The US National Institute of Standards and Technology (NIST) announced the deprecation of several Federal Information Processing Standards (FIPS), one of which is notorious with cryptographers and privacy advocates — FIPS-185 or the Escrowed Encryption Standard was introduced in the 90’s as a method of providing law enforcement with a “universal key,” primarily through key escrow with the Clipper Chip being an example implementation.

Twenty years later, we are having the same conversation again. It is almost ironic that two very close allies are having the same knee-jerk reaction to data encryption but twenty years apart; one declaring their key escrow attempt dead, while the other is resurrecting this type approach.

If we consider that encryption is akin to a digital lock that can be applied to digital information, this begs a question.

When is a Lock not a Lock?

This is essentially the discussion Olivier Thierry had with Computing UK’s John Leonard. To make his point approachable, Thierry used the TSA luggage locks as a comparison for intentional backdoors in encryption. For the sake of brevity, let’s skip to his comment on the program’s results:

“The result? An increase in reported thefts from locked luggage as thieves managed to duplicate the TSA keys.”

The TSA’s push for locks for which they held a “universal key” didn’t stick around long. They were ineffective, or as Thierry puts it, “those TSA locks on luggage are a farce – because they’re not locks.” If the “universal key” approach doesn’t work in the physical world, can it work in the digital one? We have a real-world example with the recently deprecated FIPS-185— an attempt to establish a digital “universal key,” further extended to hardware with the notorious Clipper Chip. Mark Bohannon of Red Hat did an excellent job summarizing the success of EES and the Clipper Chip,

“Ostensibly, the EES is now being withdrawn because it references a cryptographic algorithm, Skipjack, that is no longer approved for U.S. government use. But one facet especially strikes home: Whatever the reason for the proposal to withdraw the FIPS, it is a timely reminder that efforts by governments to require use of specific technologies that have not been developed in a transparent manner with broad input are not merely misguided—they are very likely to fail. Especially in areas as sensitive as that involved here.”

“Many others pointed out the distinct possibility that escrowed encryption keys could be likely obtained by unauthorized persons, and misused by overzealous government agencies. The Clipper Chip quickly gathered dust after its introduction. Skipjack was eventually declassified and published in 1998. But, by then, the lack of transparency and collaboration in its development had already had a deleterious effect, and fostered lingering suspicion.”

We have established that a “universal key” is a bad idea both in the digital and the physical world, which comes back to our question, when is a lock not a lock?

Regardless of whether physical or digital, a lock is not a lock when a fully autonomous third-party has access to the key and the ability to use that key without the knowledge of or permission from the lock’s owner.