Hacker News new | ask | show | jobs
by DanBC 4148 days ago
I'd think not.

England will imprison people who forget passwords. Here are two examples:

http://bbc.co.uk/news/uk-25745989

http://www.theregister.co.uk/2009/11/24/ripa_jfl/

2 comments

I was thinking something less obviously encrypted than a usb stick with a dialog box saying "Enter password" - how about steganography? "A password for my image?"
Does this also include using something like ephemeral keys?
To my (lay!) knowledge, no. The primary legislation indicates that to be in violation of that section the court has to believe you did have a way, when you were given an order under RIPA, to make the content they're seeking readable, and you haven't done so. If you do not possess a means to make it readable at that point because you routinely use ephemeral keys - as most people do now (specific example: ECDHE TLS ciphersuites) - you wouldn't be in violation of RIPA in that case, I believe.

Also, keys which are only used for signing are specifically exempted from disclosure in the primary legislation - so don't hand over private TLS signing keys (if, and only if, you always use ephemeral keys, not static RSA) or any GnuPG/PGP signing keys (encryption subkeys on the other hand? However, GnuPG has a way to output the symmetric keys for individual messages, allowing you to limit the damage)!

Of course, if ever presented with any such order, you absolutely need very good legal advice rather than taking it from a lay random on Hacker News. I would definitely encourage you to fight, if you can.

That's good to know, I appreciate the advice.