From: Michael Graffam <phundie@mhv.net>
Date: Mon, 30 Mar 1998 11:55:05 -0800 (PST)
To: Jeremiah Blatz <jer+@andrew.cmu.edu>
Subject: Re: Deniable Cryptography [was winnowing, chaffing etc]
In-Reply-To: <0p7xTq200YUg0CkXw0@andrew.cmu.edu>
Message-ID: <Pine.LNX.3.96.980330141710.11318A-100000@localhost>
MIME-Version: 1.0
Content-Type: text/plain


On Mon, 30 Mar 1998, Jeremiah Blatz wrote:
> "Rubber hose" cryptanalysis needn't involve actual beatings in secret
> underground cells. Simple example: Cops raid your house, rough you up
> a little bit (not much) and toss your ass in a cell with "real '
> criminals. 12 hours later they take you into a room and play good
> cop/bad cop with you. Maybe you're not sure you could stand up to
> this, and might panic and reveal more than you have to (remember, you
> haven't been charged with a crime yet). However, if you do hold out,
> the chances that you'll be let go, and get your stuff back in a few
> years, are pretty high. In this case, being able to spill a key that
> revelas harmless stuff is good, since the police are unlekely to hold
> you for a long time.

Absolutably. I understand that deniabled crypto will help against
a civilized enemy, but it is not an answer for the worst case scenario.

I maintain that algorithms aren't what we really need for this type
of key management. It is nice to be able to give up less important
keys as a matter of convienence, but as long as the user can get
the data so can an attacker.

If we have a physical system that gets key information from the user
through biological feedback that takes stress conditions, blood
pressure, etc into account then if any of these signs are out of the
norm the device can generate bad key information as a result of
this. This insures that the user will not be able to get the information
if he is being physically manipulated. This also has use in areas where we
dont want the user to be authenticated when he is in an odd
state of mind, such as when dealing with weapons systems.

I dont think that biofeedback technology is at the point to make this
usable yet, but I hope that advances are made quickly. The firearms
maker Colt has explored authentication devices for their weapons,
but I dont know the details.

Michael J. Graffam (mgraffam@mhv.net)
http://www.mhv.net/~mgraffam -- Philosophy, Religion, Computers, Crypto, etc
"..subordination of one sex to the other is wrong in itself, and now
one of the chief hindrances to human improvement.." John Stuart Mill
"The Subjection of Women"