Cryptography vs. Mass Surveillancecms16.item.ntnu.no/slides/rogaway.pdf · Before Snowden 2014...
Transcript of Cryptography vs. Mass Surveillancecms16.item.ntnu.no/slides/rogaway.pdf · Before Snowden 2014...
1 / 35
Imagecredit:“AdventuresinAnima3on3D”(2004)PhillipRogawayDepartmentofComputerScienceUniversityofCalifornia,Davis,USA
Cryptographyvs.MassSurveillance
WiththankstoS8gMjølsnesandBri<aHaleforinvi3ngmeandarrangingmyvisit!
TalkforCryptovs.MassSurveillance:TheUneasyRela8onshipworkshop14November2016Trondheim,Norway
2 / 35
The3tleimaginesthetwostandinginopposi8on.Dothey?
Fromadescrip8vestandpoint:no.Cryptohasnotbeeneffec3veatcurtailingmasssurveillance…andmostcryptographersdonotseethisasourrole.
Fromanorma8vestandpoint:maybe.Manythinkcryptographyshouldstandinopposi3ontomasssurveillance.Butnotatallclearthatitcould.
Oughtimpliescan.
WHYhasn’tcryptohelped?
CANcryptohelp?
Cryptographyvs.MassSurveillance
3 / 35
Cryptography–thescienceofsecurecommunica8ons.
Masssurveillance–thespectacularfailuretosecurecommunica3ons.
Youwouldthink• thesewouldbeinopposi3on,andthat• cryptographerswouldbeaghastbymasssurveillancerevela3ons.
You’dbewrong.Mostofmycommunitydoesn’tseeaconnec3on,andthinksthingsaregoinggreat.
4 / 35
ArosyassessmentofCS
Computerscienceismarkinganepicalchangeinhumanhistory.Weareconqueringanewandvastscien3ficcon3nent.…Virtuallyallareasofhumanac3vity…[and]virtuallyallareasallareasofhumanknowledge…arebenefi]ngfromourconceptualandtechnicalcontribu3ons.…Longlivecomputerscience!
CryptographerSilvioMicali
TuringAwardacceptancespeech15June2013
Abouta1.5weeksaaertheini3alSnowdenrevela3ons(Verizon+PRISM)
5 / 35
2013IACR-sponsoredconferences156papers(3067pages)0paperswiththeword“surveillance”
BeforeSnowden
2014IACR-sponsoredconferences155papers(2910pages)1paperwiththeword“surveillance”(mine)
AQerSnowden
2015:1paper2016:3papers
Cryptographersdon’tcareaboutmasssurveillance
2011:0papers2012:0papers
(workon)
6 / 35
The Summer of Snowden 2013
7 / 35
Whywasn’tIpayingmorea<en8ontothisearlier?
1993ClipperChip1980
200920021983
BillBinney
ThomasDrake
KirkWiebe
MarkKlein
DianeRoark
8 / 35
2013/451CandidateIndis8nguishabilityObfusca8onandFunc8onalEncryp8onforallcircuitsSanjamGargandCraigGentryandShaiHaleviandMarianaRaykovaandAmitSahaiandBrentWaters2013/454HowtoUseIndis8nguishabilityObfusca8on:DeniableEncryp8on,andMoreAmitSahaiandBrentWaters2013/471Obfusca8ngConjunc8onsZvikaBrakerskiandGuyN.Rothblum2013/500Obfusca8ngBranchingProgramsUsingBlack-BoxPseudo-FreeGroupsRanCaneEandVinodVaikuntanathan2013/509ReplacingaRandomOracle:FullDomainHashFromIndis8nguishabilityObfusca8onSusanHohenbergerandAmitSahaiandBrentWaters2013/557Black-BoxObfusca8onford-CNFsZvikaBrakerskiandGuyN.Rothblum2013/563VirtualBlack-BoxObfusca8onforAllCircuitsviaGenericGradedEncodingZvikaBrakerskiandGuyN.Rothblum2013/601Two-roundsecureMPCfromIndis8nguishabilityObfusca8onSanjamGargandCraigGentryandShaiHaleviandMarianaRaykova2013/631Protec8ngObfusca8onAgainstAlgebraicA<acksBoazBarakandSanjamGargandYaelTaumanKalaiandOmerPanethandAmitSahai2013/641Indis8nguishabilityObfusca8onvs.Auxiliary-InputExtractableFunc8ons:OneMustFallNirBitanskyandRanCaneEandOmerPanethandAlonRosen2013/642Mul8partyKeyExchange,EfficientTraitorTracing,andMorefromIndis8nguishabilityObfusca8onDanBonehandMarkZhandry2013/643ThereisnoIndis8nguishabilityObfusca8oninPessilandTalMoranandAlonRosen2013/650OnExtractability(a.k.a.Differing-Inputs)Obfusca8onEleMeBoyleandKai-MinChungandRafaelPass2013/665TheImpossibilityofObfusca8onwithaUniversalSimulatorHenryCohnandShafiGoldwasserandYaelTaumanKalai2013/668Obfusca8onforEvasiveFunc8onsBoazBarakandNirBitanskyandRanCaneEandYaelTaumanKalaiandOmerPanethandAmitSahai
Cryptographers–toobusywithiOtono8ceSnowden?
9 / 35
10 / 35 ReleasedbyDerSpiegel,Sept9,2013
11 / 35
Nohumanunderstandswhat’sgoingon
Execu3veorder12333 FISA
FISAAA
PATRIOTAct
HSPD-23PPD-20 FreedomAct CALEA
ECPA
ACLU+ProPublica
12 / 35
Howmanycopiesofthecommunica3onsarearchived,bywhom,forhowlong?Whatalgorithmsareapplied–orwillbeapplied–tothedata?Whatisthedatacombinedwith?Whenmightahumananalystbecomeinvolved?Whatconsequencesmightstemfromthecommunica3onscontent?
Thebasicsarenotknown
Secrecy+Complexity• Reducesthepossibilityofeffec3vereform.• Isitselfanexerciseoftradecraa.
Phone,EmailSkype,SMS,
PGP/Windows,…
Phil Mihir
13 / 35
Whilethere’snooneanswer,thereisonethemeexplainingthedisinclina>ontohelp:
It’stheculture,stupid.
Socryptographershavebeendisinclinedtoworkonmasssurveillance,anddon’tseecryptoasrelevant.
ButWHY?
Amorespecificanswer.Withabitofanexplana3on.
14 / 35
Fromwheredidthisdisciplinaryculturecome?
15 / 35
[GM]Goldwasser,Micali–STOC1982(JCSS84)Probabilis3cencryp3onandhowtoplaymentalpokerkeepingsecretallpar3alinforma3on[GMR]Goldwasser,Micali,Rivest–FOCS84(SIAM88)A“paradoxical”solu3ontothesignatureproblem[GMR]Goldwasser,Micali,Rackoff–STOC85(SIAM89)Theknowledgecomplexityofinterac3veproofsystems[GMW1]Goldreich,Micali,Wigderson–FOCS86(JACM91)Proofsthatyieldnothingbuttheirvalidityandamethodologyofcryptographicprotocoldesign[GMW2]Goldreich,Micali,Wigderson–STOC87HowtoplayanymentalgameorAcompletenesstheoremforprotocolswithhonestmajority
ShafiGoldwasser SilvioMicaliRonRivest
• Abranchoftheory• Problemselec8on:aesthe8cs,philosophy
• Youthful• Iconic,paradigma8cworksthat
capturedtheimagina8on
MITLabforComputerScienceTheoryofComputa8onGroupCryptography–mid-1980’s
Foundingethos.Cryptoistheory,philosophy,andimagina3on.
Embeddedethos.Thisethosremainsdominant,con3nuallyrenewedbytechnicalandnontechnicalchoices.
16 / 35
Scien8ficrealismCisasitisbecauseofthenatureofrealityCisinevitableCisobjec3ve,ahistorical,andpoli3callyneutralCisbutsuperficiallyshapedbythedisciplinarycultureCisascience.Wediscoverit.
Whatiscryptography?Philosophically…Sociologically…
“TheScienceWars”asprojectedontomycorneroftheworld
cryptographicresearchisindeedpartofscience.Thisasser3onisempiricalanditreferstothecurrentsociologyofthediscipline;thatis,webelievethatthevastmajorityofthemembersofthisresearchcommunityiden3fythemselvesasscien3sts…OnPost-ModernCryptography,OdedGoldreich,2006
C=moderncryptography
17 / 35
thebodyofworkourcommunityhasproducedislesstheinevitableconsequenceofwhatweaimtostudythanthecon3ngentconsequenceofsensibili3esandassump3onswithinourdisciplinaryculture…Iwouldclaimthatcryptography,eveninitsmostpureandscien3ficpersona,isquitestronglyconstructed.PracSce-OrientedProvable-SecurityandtheSocialConstrucSonofCryptography,P.Rogaway,2009
Socialconstruc8onismCneednotbeasitis.ItisnotinevitableCisnotdeterminedbythenatureofthings.ClookslikeitdoesduetosocialandhistoricalforcesCisshapedbythedisciplinarycultureCisatechnology.Weinventit.
“TheScienceWars”asprojectedontomycorneroftheworld
Whatiscryptography?Philosophically…Sociologically…
C=moderncryptography
18 / 35
Irrelevance.Imagina3on-genesisworkcan’tactuallyfindaroutetoprac3ce.
Whenmostcryptographersareblue…
Hereforfun.Intellectualityassport—pragma3smassmall-mindedness.
Standardiza8onnon-par8cipa8on.Cryptostandardswithoutthecryptographers.
Distancedfromsecurity.Cryptographersdon’tseeevenprominentsecurityproblemsbecauseofcommunitystructure.
Value-neutralview.Themyththatscienceandtechnologyisvalue-neutral.
1 12
811
9
2319
3.Technologyitselfisvalue-neutral:itiswhathumansdowithtechnologythatis
right/wrong.
Endofterm
Beginning-oftermsurveydatafrommyclassECS188“EthicsinanAgeofTechnology”,W13
“Technologyitselfisvalue-neutral:itiswhathumansdowithtechnologythatisrightorwrong.”
StronglyagreeStronglydisagree
19 / 35
D. Chaum, Untraceable electronic mail, return addresses, and digital pseudonyms CACM 1981 (4368 citations)
S. Goldwasser and S. Micali, Probabilistic encryption
STOC82+JCSS 1984 (3733 citations)
Spawned Disjoint Communities
Communityfracture.Spli]ngoffofPETS,symbolicapproachestocrypto,…
GrewintothePETScommunity
GrewintotheIACRcommunity
20 / 35
Y.Lindell
J.Groth
P.Rogaway
Adversariesareno8onal.Wejokeaboutthem.Weseecryptoasagame.
Formostcryptographers…
Adversarialabstrac8on.Trea3ngtheadversaryno3onally.
¹
21 / 35
(U)Threeofthelastfoursessionswereofnovaluewhatever,andindeedtherewasalmostnothingatEurocrypttointerestus(thisisgoodnews!).(U)Therewerenoproposalsofcryptosystems,nonovelcryptanalysisofolddesigns,evenverylivleonhardwaredesign.Ireallydon’tseehowthingscouldhavebeenbeMerforourpurposes.(U)Theconferenceagainofferedaninteres3ngviewintothethoughtprocessesoftheworld’sleading“cryptologists.”ItisindeedremarkablehowfartheAgencyhasstrayedfromtheTruePath.
EUROCRYPT’92report:
Ourirrelevancehasn’tbeenlostonpower
[emphasismine]
Unthreateninglyengaged.We’rehappytodostuffirrelevanttopower.
22 / 35
Whynoreac8on?
• NothingIknowisrelevant.• ThesearepoliScalissues;
Iamnotanexpertonpublic-policy;thisisnotourprofessionalconcern.
Extremespecializa8on.Canrobscien3stsofanysenseofagency.
Ifone’stechnicalworkisn’tevenrelevanttosecurity,howisitsupposedtoberelevanttoasocio-technicalproblemlikethis?
AnOpenLe<erfromUSResearchersinCryptographyandInforma8onSecurity
January24,2014
Media reports since last June have revealed that the US government conducts domes3c and interna3onal surveillance on a massive scale, that it engages indeliberate and covert weakening of Internet security standards, and that it pressures US technology companies to deploy backdoors and other data-collec3onfeatures.AsleadingmembersoftheUScryptographyandinforma3on-securityresearchcommuni3es,wedeploretheseprac3cesandurgethattheybechanged.Indiscriminatecollec3on,storage,andprocessingofunprecedentedamountsofpersonalinforma3onchillfreespeechandinvitemanytypesofabuse,rangingfrommissioncreepto iden3ty thea.Thesearenothypothe3calproblems; theyhaveoccurredmany3mes in thepast. Inser3ngbackdoors, sabotagingstandards,andtappingcommercialdata-centerlinksprovidebadactors,foreignanddomes3c,opportuni3estoexploittheresul3ngvulnerabili3es.Thevalueofsociety-widesurveillanceinpreven3ngterrorismisunclear,butthethreatthatsuchsurveillanceposestoprivacy,democracy,andtheUStechnologysector is readily apparent. Because transparency and public consent are at the core of our democracy, we call upon the US government to subject all mass-surveillanceac3vi3estopublicscru3nyandtoresistthedeploymentofmass-surveillanceprogramsinadvanceofsoundtechnicalandsocialcontrols. Infindingawayforward,thefiveprinciplespromulgatedathvp://reformgovernmentsurveillance.com/provideagoodstar3ngpoint.ThechoiceisnotwhethertoallowtheNSAtospy.Thechoiceisbetweenacommunica3onsinfrastructurethatisvulnerabletoavackatitscoreandonethat,bydefault,isintrinsicallysecureforitsusers.Everycountry,includingourown,mustgiveintelligenceandlaw-enforcementauthori3esthemeanstopursueterroristsandcriminals,butwecandosowithoutfundamentallyunderminingthesecuritythatenablescommerce,entertainment,personalcommunica3on,andotheraspectsof21st-century life.Weurge theUSgovernment to reject society-wide surveillanceand the subversionof security technology, toadopt state-of-the-art,privacy-preservingtechnology,andtoensurethatnewpolicies,guidedbyenunciatedprinciples,supporthumanrights,trustworthycommerce,andtechnicalinnova3on.
h<p://masssurveillance.info/
53signatories58%acceptancerate4.5months>900emails
Topreasonsstatedfornotsigning:
Nopoli8cs.Anunwillingnesstoengageinanything“poli3cal”connectedtooneswork.
23 / 35
Abig-datacandidatewerecentlyinterviewed
I’mabodywithoutasoul.
Dissocia8on.Abeliefthatitisreasonabletodissociateonesethicalbeingfromoneswork.
Someofyourworkcouldhavetroublingapplica3ons.Couldyoudescribeyourpersonalviewonthesocialresponsibili3esofcomputerscien3sts?
24 / 35
“Itoldher[mywife,circa1976]thatwewereheadedintoaworldwherepeoplewouldhaveimportant,in3mate,long-termrela3onshipswithpeopletheyhadnevermetfacetoface.Iwasworriedaboutprivacyinthatworld,andthat’swhyIwasworkingoncryptography.”WhitDiffie,tes8fyingattheNeweggvs.TQPpatenttrial,21November2014
Changingmo8va8ons
Changingmo8va8ons.Current-genera3oncryptographersaren’tinitformoralorsocio-poli3calreasons.
Careerism.Whatwedoalignswiththeacademicrewardsystem.
(Writelotsofpapersappreciatedenoughtogetinto3er-1venues.Bringinplentyofmoney.)
RalphMerkle–Mar8nHellman--WhitDiffie
25 / 35
DoDFundinginCryptography,2000-2015
0
10
20
30
40
50
60
70
80
90
100
2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015
PercentageofCRYPTOpapersthatacknowledgeUSDoDfundingamongallpapersthatacknowledgeUSextramuralfunding
Sensibili8esforsale.Youdon’tbitethehandthatfeedsyou.
26 / 35
Fear.Youwanttoavractmoreaven3ontoyourself!?
27 / 35
Whyarethestrongestcrypto-advocatesnon-cryptographers?
Missingaqtude.Welacktheenergyandsenseofpurposeofthecypherpunks.
AmissingaEtude–thatofthecypherpunks.
StevenLevy,“CryptoRebels”,Wired,May/June1993.
TimMay–EricHughes–JohnGilmore
Butwediscoveredsomething.Ouronehopeagainsttotaldomina3on.Ahopethatwithcourage,insightandsolidaritywecouldusetoresist.Astrangepropertyofthephysicaluniversethatwelivein.¶Theuniversebelievesinencryp3on.¶Itiseasiertoencryptinforma3onthanitistodecryptit.JulianAssange,2012
…Wemustdefendourownprivacyifweexpecttohaveany.Wemustcometogetherandcreatesystemswhichallowanonymoustransac3onstotakeplace.…¶WetheCypherpunksarededicatedtobuildinganonymoussystems.Wearedefendingourprivacywithcryptography,withanonymousmailforwardingsystems,withdigitalsignatures,andwithelectronicmoney.EricHughes,1993
In words form history, let us speak no more of faith in man, but bind him down frommischiefbythechainsofcryptography.EdwardSnowden,2013
28 / 35
Privacyisapersonalgood
Inherentlyinconflict
Securityisacollec8vegood
Encryp3onhasdestroyedthebalance.Privacywins
RiskofGoingDark.
Thebadguysmaywin
“Going-Dark”Framing U.S.FBIDirectorJamesComey
29 / 35
Makespeopleconforming,
fearful,boring.S3flesdissent
Surveillanceisan
instrumentofpower
Tiedtocyberwarandassassina8ons
Technologymakesitcheap
Privacyisasocialgoodrarelyinconflictwithsecurity
Thecostsofsurveillancearenotbornequally
DrawingbysixyearolddaughterofSteveMann
Misframing.Accep3ngafic33ousstorylineofwhatsurveillanceisfor.
“Golden-AgeofSurveillance”Framing
30 / 35
Crypto
Crypto-for-PrivacyCrypto-for-SecurityCrypto-for-CryptoCrypto-for-Power
Maybecryptowillsaveus
31 / 35
Maybecryptowillsaveus
1. Encryp3onworks,andhasanaturaldemocra3zingtendency.2. Cryptographersanddevelopersaresmart,3. Andtheworkcanberelevant.4. Metadataconcealmentispossible,andisalreadydone(inTor).5. End-to-endanddeviceencryp3onisbecomingpopular.6. Open-source,open-hardwaremovementofferspromise.7. Morecryptographersarebecominginterestedinprivacy.8. Andareavendingtothepoli3calimplica3onsofourwork.9. Wecanrebalancewhatwedotoputmoreemphasisoncrypto-for-privacy.
32 / 35
1. Mostofthecryptocommunityisbusythinkingaboutotherthings.2. Architecturecanmakecryptosupportthepowerfulorthepowerless.3. Endpointsareinsecure,codeisbuggy.4. Securityisa“weak-link”property,andcryptoisrarelythatlink.5. Usablesecurityhasprovenelusive.6. Nomoralcompunc3onamongcomputerscien3sts,engineers.7. Privacy-enhancingadd-onsaddcomplexityandreduceu3lity.Economic
incen3vesoaenwrong.Enormousvaluegainedbymininginforma3onflows.Valueflowstocorpora3onsandgovernments.
8. Legalprotec3onsareweak,legalinstruments(eg,NSLs)arestrong,mostjudgesdon’tunderstandtechnology.
9. Intelligenceagencieshaveenormousbudgets,operatebeyondthereachoflaw.Anything-goesmentality(even,eg,subver3ngstandardiza3onprocess).Shieldedbycomplexity,secrecy,partnerships,legalinven3on,linguis3cinven3on.
10. Opensourceisnopanacea(Linus’slaw:“givenenougheyeballs,allbugsareshallow”.NO)11. Monitoringinphysicalspace:facialrecogni3on,license-platereaders,…12. It’sallinthemetadata–andconcealingmetadatahard.13. Declineofthegeneral-purposecomputer.14. Successfulframingbygovernment15. Technologymavers,butpolicy,law,adherencetolawmavermore.16. Corpora3sm/Public-private“partnership”hasneverbeenstronger.
Butprobablynot
33 / 35
WHYhasn’tcryptohelped?
CANcryptohelp?
Cryptographershavebeendisinclinedtohelp.Thereasonsforthisarerootedinthedisciplinaryculture.
Onsomemavers–yes.Howmuchofadentcanwerealis3callymake??Wewon’tknowwithouttrying.
34 / 35
AuthoritarianismFearmongeringJingoism
Corpora8smMilitarism
RacismIncarcera8ons
Assassina8onsFascism
“eventuallytherewillbea3mewherepolicieswillchange,becausetheonlythingthatrestrictstheac3vi3esofthesurveillancestatearepolicy.…Andbecauseofthat,anewleaderwillbeelected,they’llfliptheswitch,…andtherewillbenothingthepeoplecandoatthatpointtoopposeit,andit’llbeturnkeytyranny.–E.Snowden,June6,2013
35 / 35
Safelyensconcedatthetopoftheworld?
Noway.
36 / 35
37 / 35
1. Foundingethos.Cryptoistheory,philosophy,andimagina3on.2. Embeddedethos.Thisethosremainsdominant,con3nuallyrenewedbytechnical/nontechnicalchoices.3. Hereforfun.Intellectualityassport—pragma3smassmall-mindedness.4. Irrelevance.Imagina3on-genesisworkcan’tactuallyfindaroutetoprac3ce.5. Distancedfromsecurity.Becauseofcommunitystructure.6. Standardiza8onnon-par8cipa8on.Cryptographicstandardswithoutthecryptographers.7. Value-neutralview.Themyththatscienceandtechnologyisvalue-neutral.8. Communityfracture.Spli]ngoffofPETS,symbolicapproachestocrypto,…9. Adversarialabstrac8on.Trea3ngtheadversaryno3onally.10. Unthreateninglyengaged.We’rehappytodostuffirrelevanttopower.11. Extremespecializa8on.Canrobscien3stsofanysenseofagency.12. Nopoli8cs.Anunwillingnesstoengageinanything“poli3cal”connectedtooneswork.13. Dissocia8on.Abeliefthatitisreasonabletodissociateonesethicalbeingfromoneswork.14. Changingmo8va8ons.Current-genera3oncryptographersaren’tinitformoralorpoli3calreasons.15. Careerism.Whatwedoalignswiththeacademicrewardsystem.16. Sensibili8esforsale.Youdon’tbitethehandthatfeedsyou.17. Ins8tu8onalamorality.Theprominenceofeconomicnarra3vestocrowdoutallothers18. Fear.Youwanttoavractevenmoreaven3ontoyourself?19. Missingaqtude.Welacktheenergyandsenseofpurposeofthecypherpunks.20. Misframing.Accep3ngafic33ousstorylineofwhatmasssurveillanceisfor.21. Rou8niza8on.Peoplequicklyaccepttheirnewreality,andevencometothinkit’sgood.
WHYdisinclinedtohelp
38 / 35
WilliamDavidon,1927-2013ProfessorofPhysicsHaverfordCollege,1961-1991
Theendofdissent
FBIbranchofficeinMedia,Pennsylvania.Burglarizedin1971bytheteamheadedupby
SeeBevyMetsger,TheBurglary,2014
39 / 35
WARISPEACEFREEDOMISSLAVERYIGNORANCEISSTRENGTH
1949
1999–present
Rou8niza8on.Peoplequicklyaccepttheirnewreality,andevencometothinkit’sgood.
Sani8za8onofadystopia
YevgenyZamya3n(1921)
40 / 35
UCEngineeringDeans,“UCEngineeringAnalysis,OutcomesandProposalforFutureGrowth”(2014).Presenta8ontoJ.Napolitano
Ins8tu8onalamorality
Ins8tu8onalamorality.Thetendencyofeconomicnarra3vestocrowdoutallothers,andindividualtomirrortheamoralstancesoftheirorganiza3ons.