Friday, August 06, 2010

Hand over the master keys, or else...

I find it comical that India's security agencies (now joined by several other countries) are demanding the "encryption keys" to BlackBerry devices. Can our government's security experts be ignorant of basic cryptography?

BlackBerry's encryption methods are not new, not novel, not unique, not even unusual. The technology to encrypt e-mail has existed since the early 1990s, and is called OpenPGP (after PGP or Pretty Good Privacy, the first program to implement it). It is usable on pretty much all e-mail systems and is built into Blackberries. There are no "master keys" here: each user has a public key and a private key, and messages can be encrypted with the public key but decrypted only with the private key. (Conversely, messages can be digitally "signed" with the private key and the signature can be verified with the public key). If A wants to send an encrypted message to B, A encrypts it with B's public key -- which A should have a copy of. The public key is meant to be public, and it is common for people to display it on their personal webpages and elsewhere. But B's private key is needed to decrypt it, and only B has (or should have) that key. Wikipedia has a good description of public key cryptography.

As far as I can tell, BlackBerry's "enterprise security" is a somewhat different system to secure communication between BlackBerry's servers and the customer's device, but it too is key-based cryptography (3DES or AES) that requires a private key for each device. RIM, the makers of BlackBerry, say they do not possess copies of customers' private keys, and indeed it would be alarming if they did. They are not being pioneers here (except, perhaps, in bringing it to wide use among their customers): this is standard practice in cryptography.

The government can ban BlackBerries, but it will have to ban e-mail: all email can be encrypted, using a method that dates back to 1991. And in fact it's easier than that: webmail providers such as Google Mail allow the entire session to be encrypted, and it is trivial to do this by clicking a few checkboxes (even my GMail app on my non-BlackBerry phone does this) -- so no agency can snoop without accessing Google's own servers. Perhaps our security agencies will next demand the root password for Google's data servers.

Alternatively, our government can try addressing our real security problems, and their underlying causes.

7 comments:

km said...

It is amusing to refresh my news feed and find yet another country has banned BB.

But then, almost no country seems to have meaningful security policies in place.

Rahul Basu said...

Rahul: I am not quite sure it has purely to do with handing out the private keys of customers (which of course RIM has no access to, even if it did agree to hand it over). At least the few articles I have found, recently in the NYT claims that India wants the same options given to the US Government to interpret and decode text and email. So it is probably not just the issue of PGP and its variants. Also, I don't think India's security agencies are that ignorant. It has various people with knowledge of cryptology on its committees (some from our institute) so I doubt that it's like the CRPF trying for control by shooting into a crowd! But I admit I haven't been able to find details of exactly what the Government wants - I guess that is purposely kept shrouded in secrecy. Today there is an Op-Ed defending the Governments' stands but it's clear why when you see who is writing it.

Rahul Siddharthan said...

Rahul - my point is encryption is widespread and becoming more so. The GMail app on my phone (which currently costs around Rs 8000) has a checkbox for "Always use secure network connections", and the browser interface is https by default. So the government already can't snoop on two people who use gmail to communicate. The same is true or will soon be true of most other mail providers.

And this is just for the non-technical crowd: more tech-savvy people have known how to encrypt their e-mails for nearly two decades.

The question is why RIM alone is being picked on here, and not everyone else who offers encrypted services...

Rahul Basu said...

Rahul: Yes, that I agree. You would have to shut down or ask for encryption details from a large number of email service providers. Today there is a strange news item that the Government wants to shut down or delay 3G services for security reasons. I don't see the connection expect that from the point of view of the subscriber, you are getting your packets faster (and that's really true as I see on my BSNL mobile) -- why is that more of a security threat? You can set off the bomb faster?

Rahul Siddharthan said...

It seems they are worried about "inflammatory" videos circulating via 3G networks. The idea that you could, well, stop shooting unarmed protestors seems foreign to them...

The sooner Chidambaram is out of the home ministry, the better it will be for all of us.

ys said...

Hi Rahul,
Reading you after a long gap. Nice post! Hope all is well with you and family.
Regards from Mumbai,
Sushama

Rahul Siddharthan said...

Sushama - good to hear from you too!