Hacker News new | past | comments | ask | show | jobs | submit login

We're talking about a 64-character password, not a one-time pad. Unlike a one-time pad, you can tell whether you've undone the encryption correctly. There is real information there that a third party can uncover given enough effort.



For simplicity sake we can see the password as representing a infinitive long stream for a one-time pad generator with the seed being the hash of the 64-character password.

The way programs detect if the encryption is successful is usually by looking at the first bits of information with the assumption that random collisions are unlikely to produce an expected pattern. Not all decryption systems does this however and some just give you the data as produced by the given key.

Both are however just technical details in how to turn the potentia of the random-like encryption data into information.


I'm not sure what you're trying to simplify here. If a third party can tell whether they've successfully guessed the right password, then the encrypted holds real information that the third party can learn with sufficient effort.

If it's just random bits that you need a one-time pad to decode, then there isn't any information without the decryption key.

If you're encrypting a hard drive, most encryption methods give you full certainty that you've correctly decrypted the text, in the same way that you'd have full certainty that you've correctly opened a safe and found the journal inside.


>If you're encrypting a hard drive, most encryption methods give you full certainty that you've correctly decrypted the text

I was thinking about mention it before when I wrote the above comment but it was already becoming a lengthy comment.

Truecrypt (now Veracrypt) is one of the more popular disk encryption software and was part of at least one US lawsuit in regard to revealing passwords. Truecrypt support a technique called hidden drives. The technique use the fact that free space is indistinguishable from encrypted data, so an attacker can never be fully certain if they have decrypted the whole data or just part of it.

A older and similar concept was/is utilized by Freenet project. Here the data get one-time pad encrypted using existing encrypted data blocks of same size. Each encrypted block then becomes both the key and data from the perspective of the encryption scheme, and the same block can be reused multiple times as one side of the operation for any given number of decrypted data. In order to decrypt a given file you need to first download the map that identify which blocks represent both sides of the one-time pad encryption, then the blocks which combined are twice the size of the decrypted data, and then do the operation. Freenet theorized that since any block could be the key/data for any other block you could never be certain of what information you have stored by looking at a single block. The block is just information in potentia.


Do you have any reason to think that what you're describing is what happened here? It seems unlikely to me, as it would mean that the guy could have given out a decryption key that would exonerate him.


This case has very little to do with the gliding scale between certainty and potentia. The legal system usually do not care about technicalities of technology but rather the interpretation of legal arguments. In here the Foregone Conclusion Doctrine is not about the existence of the data. The idea is that the government must already know a certain amount, and the dispute is over how much they know. In the case of the journal, some courts have find that the government need to know about the journal and that they contain authentic evidence in order to argue a forgone conclusion, while other courts think it is enough that the government know about the wall safe. Courts that demand that the government know about the content usually reject the case and the opposite for the later.

It is also important to understand that its not the journal itself that get subpoena. In the later case it is the wall case, with the government arguing that all locked wall cases must contain an unlocked wall case. The conclusion of the existence of an unlocked wall case is thus a forgone conclusion, with the content within being irrelevant to the argument.

The court in this case looked at this and said "The Commonwealth is seeking the password, not as an end, but as a pathway to the files being withheld". This basically mean that they don't accept the argument that the government can request the password based on the simple fact that an encrypted disk exist. Thus the focus is changed away from the container and onto the information within, and here the court do not think the government has enough information to prove a forgone conclusion.


I'm a bit confused about what you're saying here. We've already established that a court can't force you to provide the password to open a wall case. Why does it matter whether they know about the container or the contents?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: