plausibly deniable encryption :: spacetime.dev
[home:<br>:rss/atom]
It is safe to assume that in any useful cryptosystem Ck<br>there exists at least one person with access to the key k<br>. An adversary with sufficient leverage can bypass the computational cost of a conventional attack by exerting their influence on this person.
xkcd - security
The technique is sometimes referred to as rubber-hose cryptanalysis and it gives the adversary some serious creative freedom. The security properties of the cryptosystem now rely not on the assumed difficulty of mathematical trapdoor functions but on some person’s tolerance to physical or psychological violence. A thief knows that pointing a gun will unlock a safe much faster than using a drill. An adversarial government will similarly seek information using torture and imprisonment rather than computational power.
Many countries have key-disclosure legislation. In the United Kingdom, RIPA was first used against animal-rights activists to unlock data found on machines seized during a raid on their homes. The penalty for refusing to hand over key material is up to two years in prison.
Say Alice has a cryptosystem Ck<br>whose security properties rely on the secrecy of the key k<br>. To defend against attacks of this form Alice needs some way to keep k<br>a secret. She could,
Claim that k<br>is not known. This includes if it has been lost or forgotten.
Claim the ciphertext c<br>is random noise and so is not decryptable.
Provide an alternate key j<br>under which decryption produces a fake plaintext.
Suppose Mallory is the adversary who wants k<br>and suppose Alice makes a claim X<br>in order to avoid revealing k<br>. Defining success can be tricky as Mallory can ultimately decide not to believe any claim that Alice makes. However we will simply say Mallory wins if she can show ¬X<br>and therefore assert that Alice has access to k<br>and is able to provide it. So for Alice to win, X<br>must be unfalsifiable and hence a plausible defence.
As a side note, if Alice knows and can demonstrate ¬X<br>whereas Mallory cannot, then clearly she is missing some necessary information. Kerckhoffs’s principle says that the security of a cryptosystem Ck<br>should rely solely on the secrecy of the key k<br>, so in general we want proving ¬X<br>to require knowing k
We will ignore weaknesses related to operational security or implementation. For example if Mallory hears Alice admit to Bob that she is lying or if she finds a fragment of plaintext in memory then Alice has lost. However these situations are difficult to cryptographically protect against and so we assume security in this regard.
Pleading ignorance (1) of k<br>is an easy strategy for Alice as it leaves little room for dispute and it can be deployed as a tactic almost anywhere. Mallory must show that k<br>is known and this is difficult to do without actually producing it. Perhaps the key was on a USB device that has been lost, or was written down on a piece of paper that burned down along with Alice’s house. Mere forgetfulness however implies that the data does exist and the only barrier to retrieving it is in accessing Alice’s memories. This may not be satisfactory.
Asserting the non-existence (2) of the ciphertext is equivalent to claiming that k<br>does not exist and so cannot be disclosed. Plausibility comes from the fact that ciphertext is indistinguishable from random noise. This means that given some potential ciphertext c<br>an adversary cannot say if c<br>is uniformly sampled or if c=Ek(m)<br>is a valid message m<br>encrypted under some key k<br>. To prove that c<br>is not random noise Mallory must produce k<br>and compute m<br>, which is assumed to be infeasible.
TrueCrypt and VeraCrypt allow the creation of hidden volumes and hidden operating systems. The idea is that an ordinary encrypted volume will have unused regions of the disk filled with random data, and so a hidden volume can be placed there without revealing its existence.
On-disk layout of an encrypted VeraCrypt volume.
Suppose we have a boot drive with a standard volume protected by the key k1<br>and a hidden volume protected by the key k2<br>. The existence of the unencrypted boot-loader reveals the fact that the standard volume exists and so Mallory can confidently demand its key. Alice may safely provide Mallory with k1<br>thereby revealing the innocuous contents of the standard volume. However when Alice enters k2<br>, the boot-loader fails to unlock the standard region so instead it tries to decrypt at the offset where the hidden volume’s header would reside. If the hidden volume exists and if the provided key is correct, this operation is successful and the boot-loader proceeds to boot the hidden operating system.
This is an example of providing a decoy decryption (3) but you may notice that Alice also had to claim that the remaining “unused” space on the drive is random noise (2) and not valid ciphertext. The necessity of a secondary claim is not a special case but a general...