Subject: [Pearg] Fwd: [Busec] Virtual BUsec seminar Wed 9/30 at 9:45 am: Sarah Scheffler, "Protecting Cryptography from Self-Incrimination"

From: "David R. Oran" <[email-masked]>
Date: Sat, 26 Sep 2020 10:11:26 -0400

This work might be of interest to the PEARG community.

DaveO

Forwarded message:

> From: Sarah Scheffler <[email-masked]>
> To: busec <[email-masked]>
> Subject: [Busec] Virtual BUsec seminar Wed 9/30 at 9:45 am: Sarah 
> Scheffler, "Protecting Cryptography from Self-Incrimination"
> Date: Fri, 25 Sep 2020 10:26:53 -0600
>
> *Date/time: *Wed 9/30 at 9:45am ET
> *Zoom link: *
> https://bostonu.zoom.us/j/222968851?pwd=RTBhSnVnbDhqbnFrMWRSeVU1alYyUT09
> *Meeting ID: *222 968 851
> *Password: *115101
>
> -
>
> *Speaker: *Sarah Scheffler
> *Title: *"Protecting Cryptography from Self-Incrimination"
> *Abstract: *
> The information security community has devoted substantial effort to 
> the
> design, development, and universal deployment of strong encryption 
> schemes
> that withstand search and seizure by computationally-powerful 
> nation-state
> adversaries. In response, governments are increasingly turning to a
> different tactic: issuing subpoenas that compel people to decrypt 
> devices
> themselves, under the penalty of contempt of court if they do not 
> comply.
> Compelled decryption subpoenas sidestep questions around government 
> search
> powers that have dominated the Crypto Wars and instead touch upon a
> different (and still unsettled) area of the law: how encryption 
> relates to
> a person's right to silence and against self-incrimination.
>
> In this work, we provide a rigorous, composable definition of a 
> critical
> piece of the law that determines whether cryptosystems are vulnerable 
> to
> government compelled disclosure in the United States. We justify our
> definition by showing that it is consistent with prior court cases. We
> prove that decryption is often not compellable by the government under 
> our
> definition. Conversely, we show that many techniques that bolster 
> security
> overall can leave one more vulnerable to compelled disclosure.
>
> As a result, we initiate the study of protecting cryptographic 
> protocols
> against the threat of future compelled disclosure. We find that secure
> multi-party computation is particularly vulnerable to this threat, and 
> we
> design and implement new schemes that are provably resilient in the 
> face of
> government compelled disclosure. We believe this work should influence 
> the
> design of future cryptographic primitives and contribute toward the 
> legal
> debates over the constitutionality of compelled decryption.
>
> *Bio:*
> Sarah is a fifth-year PhD student in the crypto/security group at 
> Boston
> University, advised by Prof. Mayank Varia. Her research examines 
> topics in
> the intersection of law and cryptography, as well as zero-knowledge 
> and
> secure messaging.

> _______________________________________________
> Busec mailing list
> [email-masked]
> https://cs-mailman.bu.edu/mailman/listinfo/busec

---

From: Heinrich Feuerbach <[email-masked]>
Date: Sun, 27 Sep 2020 10:59:28 +0200

Hello Dave,

one working Ansatz is already there to solve this issue: it is the
possibility of having a private partition in an eg. USB stick, beneath
a "public" partition. So to hide encrypted volumes inside another (as
well encrypted) volume. In case of trying to enforce decryption, one
would just decrypt the "outer" volume, containing nothing really
important to the user. So, no way to have or get evidence of another
volume inside, which contains really confidential data, as everything
is held as random bytes on the same disk. 
Example is the tool "VeraCrypt".

Cheers,
Hein

On Sat, 26 Sep 2020 10:11:26 -0400
"David R. Oran" <[email-masked]> wrote:

> > The information security community has devoted substantial effort
> > to the
> > piece of the law that determines whether cryptosystems are
> > vulnerable to
> > definition by showing that it is consistent with prior court cases.
> > We prove that decryption is often not compellable by the government
> > under our
> > against the threat of future compelled disclosure. We find that
> > secure multi-party computation is particularly vulnerable to this
> > threat, and we
> > government compelled disclosure. We believe this work should
> > influence the

---

From: DNR <[email-masked]>
Date: Mon, 28 Sep 2020 07:44:58 -0400

Thanks for the reference. Here is a link to the paper: 
https://eprint.iacr.org/2020/862.pdf

ChuckW

On 9/26/2020 10:11 AM, David R. Oran wrote:
>     *Zoom link:
>     *https://bostonu.zoom.us/j/222968851?pwd=RTBhSnVnbDhqbnFrMWRSeVU1alYyUT09
>     <https://bostonu.zoom.us/j/222968851?pwd=RTBhSnVnbDhqbnFrMWRSeVU1alYyUT09>*
>     *
>     to the design, development, and universal deployment of strong
>     encryption schemes that withstand search and seizure by
>     computationally-powerful nation-state adversaries. In response,
>     governments are increasingly turning to a different tactic:
>     issuing subpoenas that compel people to decrypt devices
>     comply. Compelled decryption subpoenas sidestep questions around
>     government search powers that have dominated the Crypto Wars and
>     instead touch upon a different (and still unsettled) area of the
>     law: how encryption relates to a person's right to silence and
>     against self-incrimination.
>
>     critical piece of the law that determines whether cryptosystems
>     are vulnerable to government compelled disclosure in the United
>     States. We justify our definition by showing that it is consistent
>     with prior court cases. We prove that decryption is often not
>     compellable by the government under our definition. Conversely, we
>     show that many techniques that bolster security overall can leave
>     one more vulnerable to compelled disclosure.
>
>     protocols against the threat of future compelled disclosure. We
>     find that secure multi-party computation is particularly
>     vulnerable to this threat, and we design and implement new schemes
>     that are provably resilient in the face of government compelled
>     disclosure. We believe this work should influence the design of
>     future cryptographic primitives and contribute toward the legal
>     Boston University, advised by Prof. Mayank Varia. Her research
>     examines topics in the intersection of law and cryptography, as
>     well as zero-knowledge and secure messaging.
>
>     <https://cs-mailman.bu.edu/mailman/listinfo/busec>
>
>