Re: [saag] CNN Says: Encryption a growing threat to security

[Nico Williams <[e-mail]>]

On Tue, Aug 04, 2015 at 11:54:17AM +0300, Yoav Nir wrote:
> The movie is not new but the text is. It specifically talks about
> communications, giving email and messaging apps as examples. While the
> encryption of messages in transit is not widely deployed on the
> Internet, setting up even S/MIME or PGP among a small group is fairly
> easy and overcoming it is hard.

Small groups of people using S/MIME or PGP (encryption) is just a source
of even more interesting metadata.  80% of e-mail traffic using S/MIME
or PGP (encryption) would notionally reduce the ability of intel
agencies to collect message plaintexts, but the metadata would still be
plenty, and anyways, any e-mail infrastruction and MUA enhancements that
could get us to such pervasive encryption would likely provide many MITM
opportunities and other means of gathering data (think of CALEA, at
least for sites like gmail and hosted domains -- no crypto backdoors,
just forced access for LEAs).

To me it seems like the impact of civilian crypto on intel agencies is
mostly this: curtailing the amount of plaintext and metadata that can be
massively gathered on web browsing.  The web is perhaps the use case
with the most pervasive civilian end-to-end crypto.  Metadata is really
where the game is at, and TLS + CDNs -> some opacity as to that,
especially if we did something strong enough as to DNS privacy (though I
suspect we won't).  E-mail is store-and-forward, high-latency as a
social medium, but the web is real-time.  Applying CALEA-style
legislation to web sites seems difficult.  The encrypted web's higher
opacity and technical difficulty of legal surveilance compared to
e-mail's strikes me as the probable motivation for intel and LEA
opposition to civilian crypto.  Besides, CALEA doesn't help intel
agencies much.  This is all just speculation, mind you.

Nico
--