GCHQ-built phone voice encryption has massive backdoor

http://www.theregister.co.uk/2016/01/19/key_voice_encryption_protocol_has_backdoor/

by temp • 11 years ago

98 44 11 years ago

theregister.co.uk

akie• 11 years ago

Unsurprising yet depressing :(

GordonS• 11 years ago

The sad thing is that in this day and age nobody is going to be surprised by this, and most of the genral public won't even care :(

BrockSamson2• 11 years ago

Unfortunately most people appear to struggle with seeing how things like this could affect them

pbhjpbhj5• 11 years ago

Does it really affect "most people". Sure, the potential effect is there - you commit a crime and they'll check your phone records and whatever to catch you and your associates but beyond that?

Most people use their phones to talk about pretty banal things.

eternalban• 11 years ago

I am certain nearly everyone gets it. Their parents went along to get along and so will their children.

People apparently need a written sign in the washroom to remind them to wash their hands. Keep that in mind.

x5n1• 11 years ago

Yes let's let government surveillance outfits design protocols. I mean who ever though this would ever be a good idea? They will 100% of the time fail at this task.

bede• 11 years ago

I feel obliged to once again refer to Home Secretary Theresa May's on-record statement to a government committee only seven days ago:

"The UK does not undertake mass surveillance".

Make of this what you will.

mirimir3• 11 years ago

Well hey, it's not actual surveillance until a human listens or reads. Machine access doesn't count. That's how the NSA likes to style it, anyway.

SideburnsOfDoom3• 11 years ago

This is what IMHO one can make of it:

"Ms May either doesn't know what "mass surveillance" means, or she has perjured herself to Parliament." http://boingboing.net/2016/01/14/443636.html

joosters2• 11 years ago

She is technically correct, but it's a very misleading technicality. Surveillance is monitoring, and the government can claim that what they actually do is mass recording of Internet traffic.

tux3• 11 years ago

I think that is what mass surveillance is commonly understood to mean.

Trying to shift the meaning so that the GCQH can technically say there's no surveillance seems incredibly dishonest to me.

If one needs to resort to pedantry to appear to be right, then there is no better justification for their views than a fallacy.

sorokod• 11 years ago

The other word to play with is "mass", who is to say what is or isn't mass.

qubex• 11 years ago

What she _obviously_ means is that they don't weigh the mass of the whole population.

anonbanker• 11 years ago

Funny thing about the "Big Lie", it only works if it's repeated enough successfully.

James Clapper was able to repeat the big lie long enough to avoid charges of lying to congress. Ms. May has her own rodeo to deal with now. let's see how she ends up.

mirimir3• 11 years ago

Maybe "MIKEY-SAKKE" is an inside joke.

Mikey: "A seemingly innocent and sweet little boy causes murder and mayhem in his new neighborhood ..." [0]

saake: "arrested number of young" in Somali [1]

[0] http://www.imdb.com/title/tt0104870/

[1] https://translate.google.com/#auto/en/saake

triplesec• 11 years ago

This is too obscure on its own to make sense: your links should illustrate, rather than be necessary for comprehension!

mirimir3• 11 years ago

My serious point is that "MIKEY-SAKKE" is a joke. I first thought of Takashi Miike, and the “Everything I’m about to tell you is a joke.” line from Gozu. But that didn't lead anywhere. Still, isn't the Mikey association at least a little funny?

toyg3• 11 years ago

"Mikey" is likely a nod to our American friends.

conjectures2• 11 years ago

It should have been obvious to the project team that the hole would be noted, or suspected if the details were obfuscated. I'm more concerned about the waste of public money on a doomed project.

toyg3• 11 years ago

Why "doomed"? Public bodies will adopt it. People who need to work with public bodies will adopt it. And sooner or later, ISPs will be forced to adopt it.

The protocol is working as expected. It doesn't have to be technologically superior to win adoption, it will be mandated by law. It just has to be good enough for the purpose it was developed: to provide an obfuscation layer that can "keep out" casual intruders while allowing unfettered access to the security apparatus (I won't say "law-enforcement officers" because these people are actually law-breaking).

SideburnsOfDoom3• 11 years ago

It's not just that there's a half-open back door that GCHQ knows all about; now there's a half-open back door that everyone knows exists. If you wanted to break in, that's a big help to you. Why adopt this now, when sooner or later the back door will be wide open to everyone?

conjectures2• 11 years ago

"People who need to work with public bodies will adopt it."

Meaning the public sector will pay more for bespoke software.

Everyone else will most likely ignore it as an option. Who wants to invest in an 'ecosystem' built on an insecure security feature? How do you sell that to users: "with our voice calls nobody can eavesdrop on you, except, umm, the government and telcos."

wmt• 11 years ago

The original story at https://www.benthamsgaze.org/2016/01/19/insecure-by-design-p... seems to be not coping well with the traffic, here's the Google cache: http://webcache.googleusercontent.com/search?q=cache:rBNjGS8...

ianamartin• 11 years ago

Seems to me that government agencies are good at two things:

1. Failing to be any good at what they are trying to do and, 2. Using said failures to take advantage of poor people and put them in jail.

This seems like a case of both happening.

Nursie• 11 years ago

Well, what an enormous surprise this is.

GCHQ, who have been implicated in mass surveillance for many years, and who were showed by Snowden's releases to be doing lots of snooping and sniffing around indiscriminately and who haven't come under any criticism whatsoever from the UK government in light of these releass, have made a compromised encryption product that allows them to carry on doing what they do.

I'm absolutely floored by this.

n4r92• 11 years ago

The irony of this story neatly mirrors the inconsistencies in the UK government's recent response to a petition to "to abandon all ideas of trying to ban strong encryption": https://petition.parliament.uk/petitions/106369?reveal_respo... .

The government's response boiled down to

1) The Government is not seeking to ban or limit encryption.

2) The Government is clear we need ... to ensure that ... the police and intelligence agencies can ... access the content of communications of terrorists and criminals.

Not too surprising that around 26 of the 650 members of Parliament have degrees in science or technology.

pbhjpbhj5• 11 years ago

Not too surprising that around 26 of the 650 members of Parliament have degrees in science or technology. //

Is that particularly unrepresentative of the population as a whole?

porsupah• 11 years ago

Per the Office of National Statistics:

http://www.ons.gov.uk/ons/dcp171776_337841.pdf

The population we have used in this report is all adults living in the UK who were not enrolled on any educational course on the survey date. The age range we have focused on is women aged between 21 and 59 and men aged between 21 and 64. The lower age limit of 21 is used as most people will not have been able to complete a graduate level qualification before this age. However, please note also that educational systems are different across the countries of the UK. Upper age limits were used because we wished to focus on people active in the labour market. These particular ages were chosen to maintain consistency throughout the report as some sections consider time periods before changes to state pension ages. In 2013 there were 12 million graduates in the UK In April to June 2013 there were 31 million people in the UK who were not enrolled on any educational course. Breaking these people down by the highest qualification they held:

• 12.0 million, or 38% were graduates

• 6.7 million, or 21% stated that their highest qualification was of an A level standard

• 6.6 million, or 21% stated that their highest qualification was equivalent to an A* to C grade GCSE

• 3.1 million, or 10% had “other” qualifications not categorised in the UK

• 2.9 million, or 9% had no qualifications

aries19802• 11 years ago

What about the so called social sciences?

dingaling2• 11 years ago

I don't think those two statements are contradictory or inconsistent, when you Think Like A Civil Servant .

From gov.uk's perspective encryption plays a necessary role in enabling the digital economy by encrypting data in transit. They won't interfere with SSL / TLS, for example, because that would chase billions of £ of business out of the UK.

But they intend to strong-arm communications providers into giving access to the at-rest data. Whether that is encrypted or not is orthogonal to the discussion; a court order will be served, and the provider will have to respond.

Whether the provider is BT or Mr Joe Bloggs hosting his own e-mail is also irrelevant; it will be a criminal offense to fail to respond with the demanded data. Bonus points for GCHQ if this means that providers simply don't encrypt data at rest, for simplicity's sake.

tomelders• 11 years ago

So the UK government is trying to amass a toolset that wold be the stuff of wet dreams for the Stasi - but they're absolutely not going to use them for the very thing they are designed to do - even though we know they're already doing the things they say they're absolutely never going to do with he tools they say they don't have but they actually do have.

Hmmmmm. Okey dokey asshats.

What puzzles me though is this: These things aren't designed and built by politicians. They're designed and built by highly skilled people with above average intelligence. And the UK security services don't pay that much money. So who are these idealogical geniuses who are ready and willing to arm a government with tools they should not possess?

aries19802• 11 years ago

These systems most built by contractors and specialised companies such as Hacking Team https://en.wikipedia.org/wiki/Hacking_Team .

tednoob• 11 years ago

I previously worked at Cryptify AB with Cryptify Call.

I think this article misses the point somewhat. This is not a backdoor, it is the entire point of the scheme. As I understood it CESG wants MIKEY-SAKKE primarily for use within the government or within companies working for the government.

For the network owner MIKEY-SAKKE is very convenient because it satisfies the criteria for Lawful interception[1] while also enabling end users to both authenticate and encrypt messages without actually talking to the network owner after the initial trust has been established. It works well as long as the user trust the network owner and you want to protect your users from external powers while maintaining the ability to decrypt any message in the network.

[1] https://en.wikipedia.org/wiki/Lawful_interception

GCHQ-built phone voice encryption has massive backdoor

Related Stories