Untitled

By Phunda Mental
As I'm sure most of us know by now, the
world is getting to be a scary place. We are
getting placed in bondage against our wills
when there is little or no evidence that any
crime was committed, or that anyone (other
than the Feds' sense of order) was somehow
harmed.
With the latest examples of injustice, such
as those endured by Bernie S. a n d Kevin Mitnick,
it is no stretch of the imagination to envision
a case in which a person is held in
prison fo r failing to reveal her encryption key.
Certainly a warrant can be legally obtained for
such a key, and this makes sense when we understand
cryptography merely as a way to lock
away secrets. The problem with this model is
that the very same bits that serve us as locks
also serve us as identification. If a law enforcement
officer obtains the keys to our files,
he can also "prove" to our associates that "he
is us." He can sign digital contracts in our
names, and even sign digital confessions for
us. A scary proposition.
It is for these reasons that I began looking
for a way to pull one over on Joe Officer. Simply
hoping against hope that the government
will keep itself away from our keys is probably
naive.
What we would like to have is a system
where if Joe Officer demands the key to our
ciphertext file, wc can choose to supply one of
many keys. One key might reveal a love letter
to his wife, the other might reveal the complcted
works of Shakespeare. A third key
might give us our secret documents. This is
usually called deniable encryption. This term
usually carries the added stipulation that user
be able to invent keys on the fly, when pressure
is applied by enforcement to reveal a
meaningful text. I don't find this idea to be
that great though because this assumes that
the decryption is done in a black box; in other
words that law enforcement isn't watching us
and looking at our programs. They would see
us invent a key for a given plaintext.
Instead of this, I find it preferable to decide
beforehand what plaintexts will be available.
In this way, law enforcement sees us
apply a key with a given algorithm, the plaintext
simply appears out ofthat. No specialized
calculations specifically for deniability need
to take place. The enemy would know that we
probably have a means to extract other data
sets, but any additional data in there can legitimately
be said to exist to frustrate cryptanalysis,
in the terms we will use, this data is just
junk chaff. I call this type of system a "cushioned"
encryption system, that is, we set up an
alibi to fall back on beforehand. But before
we consider this method, let's look at the simplest
method of deniability.
The most obvious way to achieve this is
with a one-time pad. An OTP has the property
that a key can be constructed to reveal any
possible message of length N from ciphertext
(also of length N). To achieve this feat, however,
our key also needs to be N bytes in
length. This might be OK for a few bytes here
and there that we can remember the pad (key)
for, but in this case why not just memorize the
plaintext and be done with it?
We can store all of the pads on disk, but
not only is this troublesome to work with, Joe
Officer can simply confiscate all of the pads.
Even if the pads are encrypted with PGp, he
just demands the key to the pads instead of to
our secret document.
One-time pads just aren't going to cut it.
Enter Ron Rivest. Rivest, most widely
known for his work on the RSA public key algorithm,
recently introduced a small paper on
a method of data confidentiality that he calls
"winnowing and chaffing."
The basic wlc method is discussed in
[RlV98] and is a really interesting idea. Rivest
proposed it as a method of achieving confidentiality
without encryption: the plaintext is
transmitted in the clear. See Rivest's paper for
how this is done - ifthe material in this article
Page 20 2600 Magazine Fall 1998