Is it possible to build a secure backdoor? Maybe
THE suggestion that Western spy agencies have been sabotaging cryptography has security experts worried. What is the guarantee that a rival spy agency, a criminal gang, or even a bright teenager will not find and use one of these “backdoors”?
One way to make such a flaw safer, says Matthew Green, of Johns Hopkins university in Maryland, is public-key cryptography. This system relies on a pair of mathematically related keys. One is public, and freely available to anyone, but the other is private. Anyone can send a secure communication to someone by encrypting it with his public key. But only the intended recipient, who knows the private key, can unscramble it.
That could help build a backdoor which would remain secure even if discovered. The software would covertly send copies of messages to the NSA, scrambled with the spies’ public key and secure against decryption by anyone else. So long as the NSA can keep its private key secret the backdoor would remain unusable by others, even if it were discovered. But an insider might steal the (very valuable) private keys. And this approach works with only some systems—and not, Mr Green says, most of the cryptography recommended by the National Institute of Standards and Technology (advised by the NSA).
Another option is to weaken the encryption carefully, so that the NSA can crack it but nobody else can. Trying to break a good code without the key ought to be impossible even using the fastest computers imaginable. But a system that has been made just weak enough might be breakable by the spies, with their basements full of supercomputers, while staying beyond the reach of anyone else: crooks, hackers and the like.
A flaw in this approach is that computers get faster. Secrets protected in this way might be safeish now, but in a decade they will become vulnerable. And, of course, America is not the only country with supercomputers.
A final option is backdoors that lie dormant until they are activated remotely—for example in what might seem like a legitimate software update. Such a targeted approach could give spies access to messages of interest without exposing everyone else to the risks of using sabotaged cryptography.
Besides breaking other people’s codes, the NSA is also charged with recommending secure codes for its own government. The hope is that its cryptographers and programmers have given some thought to securing backdoors as well as to building them. But have they?
This article appeared in the International section of the print edition under the headline "Knock knock"
From the September 14th 2013 edition
Discover stories from this section and more in the list of contentsExplore the edition
That will have dramatic effects on both Russia and on the exiles themselves
Denmark and the Netherlands hope technology and planning will bail them out
Investors and broadcasters are getting interested in women’s sport