Ray Ozzie's Proposal: Not a Step Forward
Steven Levy has just published an article describing a new proposal by Ray Ozzie to solve the exceptional access problem. I don’t have time today for a detailed answer, but there are two points I want to make.
Ozzie presented his proposal at a meeting at Columbia—I was there—to a diverse group. Levy wrote that Ozzie felt that he had "taken another baby step in what is now a two-years-and-counting quest" and that "he’d started to change the debate about how best to balance privacy and law enforcement access". I don’t agree. In fact, I think that one can draw the opposite conclusion.
At the meeting, Eran Tromer found a flaw in Ozzie’s scheme: under certain circumstances, an attacker can get an arbitrary phone unlocked. That in itself is interesting, but to me the important thing is that a flaw was found. Ozzie has been presenting his scheme for quite some time. I first heard it last May, at a meeting with several brand-name cryptographers in the audience. No one spotted the flaw. At the January meeting, though, Eran squinted at it and looked at it sideways—and in real-time he found a problem that everyone else had missed. Are there other problems lurking? I wouldn’t be even slightly surprised. As I keep saying, cryptographic protocols are hard.
The other point is that security is a systems problem. To give just one example, the international problem alone is a killer issue. If the United States adopts this scheme, other countries, including specifically Russia and China, are sure to follow. Would they consent to a scheme that relied on the cooperation of an American company, and with keys stored in the U.S.? Almost certainly not. Now: would the U.S. be content with phones unlockable only with the consent and cooperation of Russian or Chinese companies? I can’t see that, either. Maybe there’s a solution, maybe not—but the proposal is silent on the issue.
