Subject: [E2ee] Does the presence of overt, "Non-Ghost" surveillance actors/bots, inhibit E2E Security?

From: Alec Muffett <[email-masked]>
Date: Wed, 28 Jul 2021 20:33:12 +0100

Hi All!

I'll be presenting this to the CFRG (Crypto Forum Research Group) at IETF
111, late on Friday evening (London time):

"A 'Duck Test' for End-to-End Secure Messaging"
https://alecmuffett.com/alecm/ietf-111/draft-muffett-e2esm-v1.18a.pdf

It's a reasonably short presentation-deck (albeit with a lot of slides)
offering a simple, robust, and easily understood metric for people to use
when judging assertions like:

*"The GCHQ 'Ghost' Proposal does not harm End-to-End Security"*
One interesting discussion that I *have* had, twice, regarding my draft is
regarding (Slide 25) whether "overt, blatant surveillance" inhibits a
system from being E2E-Secure - "because people will not be able to avoid
surveillance."

It's a great question, which I've answered with two different thought
experiments:

*Surveillance Scenario A:*
Imagine that the UK Government imposes a "Technical Capability Notice" on
WhatsApp and requires surveillance on everybody. Further imagine that
WhatsApp has the decency to tell everybody that surveillance is enabled.

Then Alice, in the UK, wants to talk to Bob with WhatsApp, but without
Surveillance. What does Alice do? Answer: there is nothing she can do
except "Fix the Government" or "Select a platform which does not implement
surveillance on behalf of the UK Government". Her intentions or desires are
incapable of changing anything about the situation, other than via
political means.

*Surveillance Scenario B:*
Say that you are using Signal to hold a group chat, and suddenly after a
month or so, it gets out that one of the people in the group chat ("Eve?")
is actually a member of the state security services.

Would that mean that Signal was suddenly no longer end-to-end encrypted?
No. If one did believe that, then E2E would have a "Schrodinger's
Cat"-quality - that it stops being E2E as soon as a spook looks at it.

But if the presence of unknown surveillance does not prevent something
being end-to-end encrypted, would the presence of *known* surveillance,
up-front, prevent something being considered end-to-end encrypted? Well,
when Eve was "outed", nothing has changed with the system other than user
choice to continue/not-continue to participate in the chat.

As 'user choice" was the only variable, user choice was also the
differentiator - including (big picture) the choice to use an individual
group chat *or* a messenger platform that was overtly enabled for state
surveillance. The choice to pull that surveilled chat or that surveilled
platform into one's own TCB/Trusted Compute Base/Zone of Trust, was a user
choice.

*Perspective*
In short: I think that "end-to-end secure messaging with state surveillance
overtly and transparently baked-in", is precisely *that*, and should be
highlighted as such, for exactly the reasons as explained in *RFC2804*.
Thus if people want to avoid surveillance, they should vote with their feet
and use a different platform, or obtain a different government; however the
surveillance should never be opaque, ghostly, or hidden.

What do others think, please?

- alec

---

From: Vittorio Bertola <[email-masked]>
Date: Thu, 29 Jul 2021 11:54:50 +0200 (CEST)

>     Il 28/07/2021 21:33 Alec Muffett <[email-masked]> ha scritto:
> 
> 
>     Hi All!
> 
>     I'll be presenting this to the CFRG (Crypto Forum Research Group) at IETF 111, late on Friday evening (London time):
> 
>     It's a reasonably short presentation-deck (albeit with a lot of slides) offering a simple, robust, and easily understood metric for people to use when judging assertions like:
> 
>     "The GCHQ 'Ghost' Proposal does not harm End-to-End Security"
> 
>     One interesting discussion that I *have* had, twice, regarding my draft is regarding (Slide 25) whether "overt, blatant surveillance" inhibits a system from being E2E-Secure - "because people will not be able to avoid surveillance."
> 
>     It's a great question, which I've answered with two different thought experiments:
> 
>     Surveillance Scenario A:
> 
>     Imagine that the UK Government imposes a "Technical Capability Notice" on WhatsApp and requires surveillance on everybody. Further imagine that WhatsApp has the decency to tell everybody that surveillance is enabled.
> 
>     Then Alice, in the UK, wants to talk to Bob with WhatsApp, but without Surveillance. What does Alice do? Answer: there is nothing she can do except "Fix the Government" or "Select a platform which does not implement surveillance on behalf of the UK Government". Her intentions or desires are incapable of changing anything about the situation, other than via political means.
> 
>     Surveillance Scenario B:
> 
>     Say that you are using Signal to hold a group chat, and suddenly after a month or so, it gets out that one of the people in the group chat ("Eve?") is actually a member of the state security services.
> 
>     Would that mean that Signal was suddenly no longer end-to-end encrypted? No. If one did believe that, then E2E would have a "Schrodinger's Cat"-quality - that it stops being E2E as soon as a spook looks at it.
> 
>     But if the presence of unknown surveillance does not prevent something being end-to-end encrypted, would the presence of *known* surveillance, up-front, prevent something being considered end-to-end encrypted? Well, when Eve was "outed", nothing has changed with the system other than user choice to continue/not-continue to participate in the chat.
> 
>     As 'user choice" was the only variable, user choice was also the differentiator - including (big picture) the choice to use an individual group chat *or* a messenger platform that was overtly enabled for state surveillance. The choice to pull that surveilled chat or that surveilled platform into one's own TCB/Trusted Compute Base/Zone of Trust, was a user choice.
> 
>     Perspective
> 
>     In short: I think that "end-to-end secure messaging with state surveillance overtly and transparently baked-in", is precisely *that*, and should be highlighted as such, for exactly the reasons as explained in RFC2804. Thus if people want to avoid surveillance, they should vote with their feet and use a different platform, or obtain a different government; however the surveillance should never be opaque, ghostly, or hidden.
> 
I think that you are mixing three separate concepts:
1) end-to-end encryption, which is a technical property of a communication system;
2) end-to-end security, which is a somewhat abstract concept possibly including other factors than just the communication system;
3) an appropriate disclosure policy for lawful interception, which is interesting but possibly out of scope for the IETF, and more in scope for law-making venues.

By the way, the apps you mention (Whatsapp and Signal) do not provide "end-to-end encryption" but "managed end-to-end encryption" - exactly for the reason you point out. A communication is end-to-end-encrypted if the text enters the communication system already encrypted; otherwise, if the communication system also manages your keys and the encryption/decryption procedure, the content is not a secret between the sender and the recipient, but only a secret between the sender, the recipient and the application maker, who could easily include features to screen and report your communication before encrypting it, either to its own servers for business purposes, or, as you suggest, to a third party.

Of course, managed e2ee is much easier to use while still providing a good degree of protection, but it requires you to trust the provider of the communication system, and there are clear reasons why people who really need absolute protection from any kind of screening should not rely on it; they should only encrypt and decrypt messages on trusted, separate applications that are not connected to the Internet. But even the average user should be made aware of the risks of managed e2ee, as it's unclear why a for-profit should provide a free communication app without monetizing users in any way; users might then want to pick a provider which is less likely to monetize them.

In terms of #3, I'm not sure if it's on topic, but I will note that by definition lawful interception happens according to a law, so the fact that it exists is public. What you as a user do not generally know is if it has been turned on on your account, but there are reasons for that, and also - in democratic countries - appropriate guarantees. Nothing would anyway prevent the app from reminding that, in some cases, your communications could be reported according to a law or court order.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked] mailto:[email-masked] 
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Alec Muffett <[email-masked]>
Date: Thu, 29 Jul 2021 19:00:50 +0100

Hi Vittorio - nice to talk to you again!

On Thu, 29 Jul 2021 at 10:54, Vittorio Bertola <
[email-masked]> wrote:
> 2) end-to-end security, which is a somewhat abstract concept possibly
including other factors than just the communication system;
> 3) an appropriate disclosure policy for lawful interception, which is
interesting but possibly out of scope for the IETF, and more in scope for
law-making venues.

Yes,  I am.  I feel that it is proper and appropriate, given that I am also
placing bounds upon how they are being discussed.

> By the way, the apps you mention (Whatsapp and Signal) do not provide
"end-to-end encryption" but "managed end-to-end encryption" [deletia]

I will let you argue definitions of end-to-end encryption with the people
authoring the relevant draft for that term; my work is focused narrowly
upon "end-to-end secure messaging".

> Of course, managed e2ee is much easier to use while still providing a
good degree of protection, but it requires you to trust the provider of the
communication system, and there are clear reasons why people who really
need absolute protection from any kind of screening should not rely on it;

Absolutely - the exercise of user choice to import (say) Signal into one's
Trusted Compute Base, is a huge and somewhat blind leap of
(reputation-based?) trust.

> In terms of #3, I'm not sure if it's on topic, but I will note that by
definition lawful interception happens according to a law, so the fact that
it exists is public. What you as a user do not generally know is if it has
been turned on on your account, but there are reasons for that, and also -
in democratic countries - appropriate guarantees. Nothing would anyway
prevent the app from reminding that, in some cases, your communications
could be reported according to a law or court order.

Exactly so, per slide 25 at
https://alecmuffett.com/alecm/ietf-111/draft-muffett-e2esm-v1.18a.pdf
perhaps something like:

> Messages you send to this chat and calls are now secured with end-to-end
encryption, but may be subject to interception or review by ourselves, and
law enforcement, safety communities, and outsourced agents from the
following national governments that we have determined from your profile
information: [...]

 ...might be appropriate for people who live in, or cross-, jurisdictions
that do not permit them to communicate privately.  You know,
totalitarian states.  That sort of thing.

    -a
--
https://alecmuffett.com/about