Damian Williamson [ARCHIVE] on Nostr: đ Original date posted:2018-01-13 đ Original message:The same problems exist ...
đ
Original date posted:2018-01-13
đ Original message:The same problems exist for users of whole disk encrypted operating systems. Once the device (or, the initial password authentication) is found, the adversary knows that there is something to see. The objective of plausible deniability is to present some acceptable (plausible) alternative while keeping the actual hidden (denied).
If the adversary does not believe you, you do indeed risk everything.
Regards,
Damian Williamson
________________________________
From: bitcoin-dev-bounces at lists.linuxfoundation.org <bitcoin-dev-bounces at lists.linuxfoundation.org> on behalf of nullius via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org>
Sent: Friday, 12 January 2018 10:06:33 PM
To: Peter Todd; Bitcoin Protocol Discussion
Subject: [bitcoin-dev] Plausible Deniability (Re: Satoshilabs secret shared private key scheme)
On 2018-01-12 at 09:50:58 +0000, Peter Todd <pete at petertodd.org> wrote:
>On Tue, Jan 09, 2018 at 12:43:48PM +0000, Perry Gibson wrote:
>>>Trezor's "plausible deniability" scheme could very well result in you
>>>going to jail for lying to border security, because it's so easy for
>>>them to simply brute force alternate passwords based on your seeds.
>>>With that, they have proof that you lied to customs, a serious
>>>offense.
>>The passphrase scheme as I understand it allows a maximum of 50
>>characters to be used. Surely even with the HD seed, that search
>>space is too large to brute force. Or is there a weakness in the
>>scheme I haven't clocked?
>
>While passphrases *can* be long, most user's aren't going to understand
>the risk. For example, Trezors blog(1) doesn't make it clear that the
>passphrases could be bruteforced and used as evidence against you, and
>even suggests the contrary: [...quote...]
I despise the term âplausible deniabilityâ; and thatâs really the wrong
term to use in this discussion.
âPlausible deniabilityâ is a transparent excuse for explaining away an
indisputable fact which arouses suspicionâwhen you got some serious
âsplainâ to do. This is usually used in the context of some pseudolegal
argument about introducing âreasonable doubtâ, or even making âprobable
causeâ a wee bit less probable.
âWhy yes, officer: I was seen carrying an axe down the street near the
site of an axe murder, at approximately the time of said axe murder.
But I do have a fireplace; so it is plausible that I was simply out
gathering wood.â
I rather suspect the concept of âplausible deniabilityâ of having been
invented by a detective or agent provocateur. There are few concepts
more useful for helping suspects shoot themselves in the foot, or
frankly, for entrapping people.
One of the worst examples I have seen is in discussions of Monero,
whereby Iâve seen proponents claim that even under the worst known
active attacks, their mix scheme reduces transaction linking to a
maximum of 20â40% probability. âThatâs not good enough to convince a
jury!â No, but it is certainly adequate for investigators to identify
you as a person of interest. Then, your (mis)deeds can be subjected to
powerful confirmation attacks based on other data; blockchains do not
exist in isolation. I usually stay out of such discussions; for I have
no interest in helping the sorts of people whose greatest concern in
life is what story to foist on a jury.
In the context of devices such as Trezor, what is needed is not
âplausible deniabilityâ, but rather the ability to obviate any need to
deny anything at all. I must repeat, information does not exist in
isolation.
If you are publicly known to be deepy involved in Bitcoin, then nobody
will believe that your one-and-only wallet contains only 0.01 BTC.
Thatâs not even âplausibleâ. But if you have overall privacy practices
which leave nobody knowing or suspecting that you have any Bitcoin at
all, then there is nothing to âdenyâ; and should a Trezor with
(supposedly) 0.01 BTC be found in your possession, thatâs much better
than âplausibleâ. Itâs completely unremarkable.
Whereas if you are known or believed to own large amounts of BTC, a
realistic bad guyâs response to your âdecoyâ wallet could be, âI donât
believe you; and it costs me nothing to keep beating you with rubber
hose until you tell me the *real* password.â
It could be worse, too. In a kidnapping scenario, the bad guys could
say, âI donât believe you. Hey, I also read Trezorâs website about
âplausible deniabilityâ. Now, I will maim your kid for life just to
test whether you told me the *real* password. And if you still donât
tell me the real password after you see that little Johnny can no longer
walk, then I will kill him.â
The worst part is that you have no means of proving that you really
*did* give the real password. Indeed, it can be proved if youâre lying
by finding a password which reveals a hidden walletâbut *you* have no
means of affirmatively proving that you are telling the truth! If the
bad guys overestimated your riches (or if theyâre in a bad mood), then
little Johnny is dead either way.
In a legalistic scenario, if âauthoritiesâ believe you have 1000 BTC and
you only reveal a password for 0.01 BTC, the likely response will not be
to let you go. Rather, âYou will now sit in jail until you tell the
*real* password.â And again: You have no means of proving that you did
give the real password!
âPlausible deniabilityâ schemes can backfire quite badly.
>Also note how this blog doesn't mention anti-forensics: the wallet
>software itself may leave traces of the other wallets on the computer.
>Have they really audited it sufficiently to be sure this isn't the
>case?
What about data obtained via the network? I donât *only* refer to
dragnet surveillance. See for but one e.g., Goldfelder, et al., âWhen
the cookie meets the blockchain: Privacy risks of web payments via
cryptocurrenciesâ https://arxiv.org/abs/1708.04748 Your identity can be
tied to your wallet all sorts of ways, any of which could be used to
prove that you have more Bitcoin than youâre revealing. Do you know
what databases of cross-correlated analysis data customs agents have
immediate access to nowadaysâor will, tomorrow? I donât.
In the scenario under discussion, that may not immediately prove âbeyond
a reasonable doubtâ that you lied specifically about your Trezor. But
it could give plenty of cause to keep you locked up in a small room
while your hard drive is examined for evidence that Trezor apps handled
*addresses already known to be linked to you*. Why even bother with
bruteforce? Low-hanging fruit abound.
>1) https://blog.trezor.io/hide-your-trezor-wallets-with-multiple-passphrases-f2e0834026eb
--
nullius at nym.zone | PGP ECC: 0xC2E91CD74A4C57A105F6C21B5A00591B2F307E0C
Bitcoin: bc1qcash96s5jqppzsp8hy8swkggf7f6agex98an7h | (Segwit nested:
3NULL3ZCUXr7RDLxXeLPDMZDZYxuaYkCnG) (PGP RSA: 0x36EBB4AB699A10EE)
ââIf youâre not doing anything wrong, you have nothing to hide.â
No! Because I do nothing wrong, I have nothing to show.â â nullius
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180113/f8efb9d9/attachment-0001.html>;
đ Original message:The same problems exist for users of whole disk encrypted operating systems. Once the device (or, the initial password authentication) is found, the adversary knows that there is something to see. The objective of plausible deniability is to present some acceptable (plausible) alternative while keeping the actual hidden (denied).
If the adversary does not believe you, you do indeed risk everything.
Regards,
Damian Williamson
________________________________
From: bitcoin-dev-bounces at lists.linuxfoundation.org <bitcoin-dev-bounces at lists.linuxfoundation.org> on behalf of nullius via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org>
Sent: Friday, 12 January 2018 10:06:33 PM
To: Peter Todd; Bitcoin Protocol Discussion
Subject: [bitcoin-dev] Plausible Deniability (Re: Satoshilabs secret shared private key scheme)
On 2018-01-12 at 09:50:58 +0000, Peter Todd <pete at petertodd.org> wrote:
>On Tue, Jan 09, 2018 at 12:43:48PM +0000, Perry Gibson wrote:
>>>Trezor's "plausible deniability" scheme could very well result in you
>>>going to jail for lying to border security, because it's so easy for
>>>them to simply brute force alternate passwords based on your seeds.
>>>With that, they have proof that you lied to customs, a serious
>>>offense.
>>The passphrase scheme as I understand it allows a maximum of 50
>>characters to be used. Surely even with the HD seed, that search
>>space is too large to brute force. Or is there a weakness in the
>>scheme I haven't clocked?
>
>While passphrases *can* be long, most user's aren't going to understand
>the risk. For example, Trezors blog(1) doesn't make it clear that the
>passphrases could be bruteforced and used as evidence against you, and
>even suggests the contrary: [...quote...]
I despise the term âplausible deniabilityâ; and thatâs really the wrong
term to use in this discussion.
âPlausible deniabilityâ is a transparent excuse for explaining away an
indisputable fact which arouses suspicionâwhen you got some serious
âsplainâ to do. This is usually used in the context of some pseudolegal
argument about introducing âreasonable doubtâ, or even making âprobable
causeâ a wee bit less probable.
âWhy yes, officer: I was seen carrying an axe down the street near the
site of an axe murder, at approximately the time of said axe murder.
But I do have a fireplace; so it is plausible that I was simply out
gathering wood.â
I rather suspect the concept of âplausible deniabilityâ of having been
invented by a detective or agent provocateur. There are few concepts
more useful for helping suspects shoot themselves in the foot, or
frankly, for entrapping people.
One of the worst examples I have seen is in discussions of Monero,
whereby Iâve seen proponents claim that even under the worst known
active attacks, their mix scheme reduces transaction linking to a
maximum of 20â40% probability. âThatâs not good enough to convince a
jury!â No, but it is certainly adequate for investigators to identify
you as a person of interest. Then, your (mis)deeds can be subjected to
powerful confirmation attacks based on other data; blockchains do not
exist in isolation. I usually stay out of such discussions; for I have
no interest in helping the sorts of people whose greatest concern in
life is what story to foist on a jury.
In the context of devices such as Trezor, what is needed is not
âplausible deniabilityâ, but rather the ability to obviate any need to
deny anything at all. I must repeat, information does not exist in
isolation.
If you are publicly known to be deepy involved in Bitcoin, then nobody
will believe that your one-and-only wallet contains only 0.01 BTC.
Thatâs not even âplausibleâ. But if you have overall privacy practices
which leave nobody knowing or suspecting that you have any Bitcoin at
all, then there is nothing to âdenyâ; and should a Trezor with
(supposedly) 0.01 BTC be found in your possession, thatâs much better
than âplausibleâ. Itâs completely unremarkable.
Whereas if you are known or believed to own large amounts of BTC, a
realistic bad guyâs response to your âdecoyâ wallet could be, âI donât
believe you; and it costs me nothing to keep beating you with rubber
hose until you tell me the *real* password.â
It could be worse, too. In a kidnapping scenario, the bad guys could
say, âI donât believe you. Hey, I also read Trezorâs website about
âplausible deniabilityâ. Now, I will maim your kid for life just to
test whether you told me the *real* password. And if you still donât
tell me the real password after you see that little Johnny can no longer
walk, then I will kill him.â
The worst part is that you have no means of proving that you really
*did* give the real password. Indeed, it can be proved if youâre lying
by finding a password which reveals a hidden walletâbut *you* have no
means of affirmatively proving that you are telling the truth! If the
bad guys overestimated your riches (or if theyâre in a bad mood), then
little Johnny is dead either way.
In a legalistic scenario, if âauthoritiesâ believe you have 1000 BTC and
you only reveal a password for 0.01 BTC, the likely response will not be
to let you go. Rather, âYou will now sit in jail until you tell the
*real* password.â And again: You have no means of proving that you did
give the real password!
âPlausible deniabilityâ schemes can backfire quite badly.
>Also note how this blog doesn't mention anti-forensics: the wallet
>software itself may leave traces of the other wallets on the computer.
>Have they really audited it sufficiently to be sure this isn't the
>case?
What about data obtained via the network? I donât *only* refer to
dragnet surveillance. See for but one e.g., Goldfelder, et al., âWhen
the cookie meets the blockchain: Privacy risks of web payments via
cryptocurrenciesâ https://arxiv.org/abs/1708.04748 Your identity can be
tied to your wallet all sorts of ways, any of which could be used to
prove that you have more Bitcoin than youâre revealing. Do you know
what databases of cross-correlated analysis data customs agents have
immediate access to nowadaysâor will, tomorrow? I donât.
In the scenario under discussion, that may not immediately prove âbeyond
a reasonable doubtâ that you lied specifically about your Trezor. But
it could give plenty of cause to keep you locked up in a small room
while your hard drive is examined for evidence that Trezor apps handled
*addresses already known to be linked to you*. Why even bother with
bruteforce? Low-hanging fruit abound.
>1) https://blog.trezor.io/hide-your-trezor-wallets-with-multiple-passphrases-f2e0834026eb
--
nullius at nym.zone | PGP ECC: 0xC2E91CD74A4C57A105F6C21B5A00591B2F307E0C
Bitcoin: bc1qcash96s5jqppzsp8hy8swkggf7f6agex98an7h | (Segwit nested:
3NULL3ZCUXr7RDLxXeLPDMZDZYxuaYkCnG) (PGP RSA: 0x36EBB4AB699A10EE)
ââIf youâre not doing anything wrong, you have nothing to hide.â
No! Because I do nothing wrong, I have nothing to show.â â nullius
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180113/f8efb9d9/attachment-0001.html>;