The senseless blackberry controversy

Suddenly the eternal debate between privacy and security has found itself in focus after some governments have suddenly seemed to have found a new security threat- humble blackberry. Of course, public is whole heartedly supporting governments- The word “security” has magical effects.

I personally think this latest controversy is essentially a hoax. Governments are simply misusing people’s lack of understanding of how encryption works to stroke public outrage. What essentially is encryption? Any information is a number for computers. Everything is saved as a sequence of 0 and 1. Now when you encrypt something you provide the data and a password to encryption software. The software simply performs complex mathematical operations on these two “numbers”. For simplicity sake lets say the original data is 10 and you provide password 8. Let’s take a very simple encryption. Say, we raise 10 to power of 8 and store the result 100,000,000(in binaries). Now, this stored number is utterly unless you know the password and mathematical operation that was performed on data. If you know that, then you simply take 8th root of 100,000,000 and get the original data as 10. If you don’t know the password, knowledge of encryption algorithm only is useless. In simple terms, x (data) y (password) =z (encrypted data). If you have only encrypted data, z then there is no way to know original data x without knowing password, y. Of course, modern encryption algorithms are much more complex than this simple example. That rules out any way to mathematically solve the equation to get possible pairs of x and y.

When you send sensitive information over internet/ mobile network, the data is routinely and automatically encrypted (without any password from you). This is to protect against hacking attacks to steal data before it reaches the intended recipient (Notice https instead of http in secure WebPages?) Once your data reaches the target server, it is again decrypted and stored securely. If blackberry is forced to share its encryption logic, the security agency can intercept and read data sent by users. Or maybe blackberry can give access to decrypted mails on its server. I am not sure of technical details of how blackberry stores data. But in essence what security agencies are trying to intercept is the communication that has been sent in good faith by user without any encryption by user himself.

Surprisingly, to circumvent security agencies armed with blackberry encryption codes is hilariously simple. Those who don’t want their communications to be sniffed will surely not rely on routine automatic encryption. They can simply encrypt the data using their own password before sending it. There are many softwares freely available to do this (TrueCrypt is a good one. You can Google it). What is happening is you are sending encrypted data z (100,000,000 instead of 10) to begin with. Blackberry will encrypt it again to say q and security agencies can again “decrypt” it back to z. But that doesn’t help if z itself is encrypted and is useless without password. Is there any way security agencies can still sniff out original data x (10) from encrypted data z (100,000,000)? NO. Without knowing the password there is no way. Only possible way is what is called brute force attack- trying to guess the password by trying out all possible combinations of keys. But a strong password and that method will take years (maybe decades for 256 bit encryption) even for supercomputers to crack. And then certain types of encryption, by their mathematical properties are immune to even this attack (http://en.wikipedia.org/wiki/Brute_force_attack ). Not surprisingly, security agencies (not only our technologically challenged police, but also FBI) have failed time and again to crack encrypted data. (Not convinced? Here are the examples- http://g1.globo.com/English/noticia/2010/06/not-even-fbi-can-de-crypt-files-daniel-dantas.html, and http://www.infoworld.com/d/security-central/red-brigades-pda-highlights-encryption-controversy-298?page=0,0 )

So what’s all this hue and cry about? I think it’s simply a backdoor entry for governments to private communications of unsuspecting users. Those who don’t want their communications to be intercepted (terrorists/ criminals) will be encrypting their data before sending anyway. Only loser is innocent end user. If any techie can give more insight on it please comment.