1

IMPORTANT NOTE: This question is quite niche, I am not sure if this stack is the most relevant place, please inform me if there is a better place for it.

To explain the question: I am asking if, a one-time-pad encryption system (brief explanation here: https://www.youtube.com/watch?v=2_w9l9visH8 ) can make any information encrypted with said system immune to prosecution – in the event that the prosecutors were to find, or believe to have*, the original key/one-time-pad that was actually used.

*The point being, the one-time-pad is not only ‘unbreakable’ - provided the security procedures/rules are kept to (no key re-use, keep key private), but given the maths – given the nature of why it is unbreakable, it is also impossible to actually know/prove beyond all doubt that you ever have the right key.

i.e: Given the nature of a one-time-pad system/its fundamental design, by itself it is impossible to determine whether or not the key is ‘correct/incorrect’. It is simply inputted and, implementing the algorithm/system, an output is given.

Given this, that it is impossible to actually prove the key is ‘correct’, if the authorities/prosecution were to ‘find’ said ‘correct key’, they cannot actually prove that the key is the correct one, therefore they cannot actually prove that the output provided by using said key is actually the original plaintext that was encrypted.

My point being: Though I assume, from previous legal cases around the world regarding infosec, that this would make any ‘evidence’ - obtained by ‘decrypting’ said data with this ‘correct key’ that any prosecution/authorities should obtain – inadmissible as they cannot actually prove said evidence ever existed, I am asking here if this is the case?

Sorry for the lengthy explanation, it is a rather niche question, I shall clarify it with an example for what I intend to actually ask; example: Say the authorities/prosecution obtain what they say is the ‘one-time-pad’ (though of course, as we know there is no irrefutable way to actually prove said claim) Said one-time-pad is then used to produce plaintext which results in incriminating material being discovered.

Is said material considered admissible evidence, given that: With some clever, (though not actually that difficult to perform) maths some geeks could quite happily engineer a ‘one-time-pad’ to produce an output of said incriminating plaintext. Regardless of this, there is no way to actually prove said key is the correct key, and so creates the situation which allows for above abuse.

I realise this may seem a very strange, obscure, niche question, but I find it interesting & I have not been able to find any real (public) history of any case where this has been so.
Before you endeavour to answer, I must add some information: I realise that even if the material is inadmissible, as it may have been created by the prosecution/authorities or otherwise, they could use this material that they believe to be correct/accurate to find other evidence – I realise this and it is not the question. Further to the above, I realise that said material could be so circumstantual a prosecution may argue it evident, i.e. the plaintext produced (with the ‘correct’ key the prosecution provides) contains an image with metadata – nevertheless this is covered under the same circumstance as the above, as of course this could have been engineered. I believe this question to be ‘on-topic’ and important/relevant as I do not believe it has been asked before here on stack-exchange, nor adequately answered/explored elsewhere. I also realise that the likelihood of authorities performing said ‘exploit’ is less likely than other exploits being performed, nevertheless the overarching point is the plaintext cannot ever actually be proved to be the actual plaintext. Anyway, I have already said that – my point here was that regardless if the authorities do not perform such exploit, it is a very real possibility that should material claimed to be plaintext ever be considered evidence, that other parties such as the prosecution (who will most likely have had access to examine/read/copy the hard drive for their own independent examination) would be able to perform such attack. Such attack would not be necessarily complex, though I’m not saying it would be in any means easy (or computationally cheap), I am just saying it is entirely possible, and again the overarching point being it is impossible to prove the key is ever said key.

And yes, I realise that a good prosecution could provide such circumstantual evidence, though in my belief circumstantual, such as: Data y was stored by/accessed by defendant, we can prove this (though not actually prove its the key), we believe this is the key (because of a,b,c,) and hence this is the plaintext of the defendants hard drive, which is therefore incriminating.

MY PRIOR RESEARCH: Of course without the key it is impossible to actually ‘decrypt’ said data (provided no key reuse), I know that authorities/prosecution wouldn’t be able to ‘decrypt’ the hard drive if they didn’t have the key. The point is, again to reiterate, that the very mathematical nature of this predicament further creates/also is the predicament that it is impossible to prove the data produced is actually the ‘original’ plaintext. Hence, given that the authorities cannot actually ‘decrypt’ the data without the key that is used, I would like to know if it is legally valid for them to say that they have done so in any case?

I am asking this as I have researched and have not found any cases that are public, neither in the scenario/principle described, nor have I even found any that actually involve unbreakable ‘one-time-pad’ encryption. I ask this as again, if it were to be legally valid then it would enable anybody to perform some clever calculations to effectively invent incriminating evidence.

https://www.schneier.com/blog/archives/2007/10/uk_police_can_n.html The comments section of this page provides interesting discussion on the topic, of which is scarce generally. The comments seem to support the idea that any one-time-pad encryption scheme properly implemented makes all ‘evidence’ produced from said data inadmissable.

https://ifca.ai/pub/fc97/r4.pdf “In 1995, it was finally divulged that the Rosenbergs, while attempting to use “one-time pad” encryption,infra, were careless in doing so, and didn’t really use a one-time pad after all. This enabled the government to develop evidence that assisted in their conviction.” The above quote from the linked paper also suggests that anything properly encrypted with a one-time-pad scheme is merely data, and that no admissible evidence can be produced.

So yes, a long question, maybe repetitive & lengthy, but I hope you can read through this as it is important to clarify.

A further DISCLAIMER: Please focus on the question, it is already long enough, I don’t wish to write an entire text on the questions I am not asking. As a final clarification, the question above has been asked clearly, however niche you may think it there are valid concerns (as are shared by those in the comments linked). I realise that you could just have the key tortured out of you by a malicious entity, this is not the question nor it is relevant, this is long enough now so I conclude.

migrated from security.stackexchange.com May 7 at 22:39

This question came from our site for information security professionals.

  • 1
    This is purely a legal question, and would be a fit on law.SE, but not here. I'll see if a mod will move it. – Xander May 7 at 22:28
  • 2
    "therefore they cannot actually prove that the output provided by using said key is actually the original plaintext that was encrypted" - the problem with that is that unless the original text was garbage in the first place, basic statistics will say that the chance of a key being generated which didn't produce garbage but in-fact produced supporting evidence that isnt the original text (either accidentally or deliberately) is negligible, and therefore the legible output is in-fact the original text. – Moo May 7 at 23:57
  • As covered in question - (assuming algorithm/method is known) - although 'axyz' or 'bnmf' could be discarded, the point is they would be so as they aren't relevant. Your point here has already been considered in the question, just because it is not 'garbage' does not make it instantly probable. Just becasue innocence is 'negligible' doesn't make guilt automatic. In this case, it is in-fact the statisitics that make each scenario indistinguishable (equal likelihood). The text is just as likely to be 'kill' as it is to be 'love'. – Reality May 8 at 0:24
  • 1
    @Moo With an OTP encrypted file it is trivial to come up with potential keys that "decrypt" the file into anything you want (of appropriate size) Actually anything. Encrypt "I didn't do it." and I will produce you a key that decrypts that to "I totally did it". It is actually trivial to do this with OTP encryption. But this is why it is secure. I can create keys to decrypt to anything, which is why I cant know which is correct. Your argument fits better with encryption schemes with limited keyspace, but not OTP. – Matt May 8 at 13:27
  • 1
    @Moo If with a search warant you uncovered a bunch of OTP keys and one decrypted the file to non-garbage, then you may have a case. But you cant just "generate" keys as your comment suggests, hoping to find one that produces an intelligible output. – Matt May 8 at 13:31
7

If it was for a criminal case, the jury would have to decide if they believed the person who claimed he/she cracked the code.

Really, any evidence is interpreted by the jury if it is regarding facts.

1) An issue of fact, not law. A question of fact is resolved by a trier of fact, i.e. a jury or, at a bench trial, a judge, weighing the strength of evidence and credibility of witnesses. Conversely, a question of law is always resolved by a judge. https://www.law.cornell.edu/wex/question_of_fact

  • Why have you limited your answer to criminal cases? Facts in civil cases are decided the same way. – Dale M May 8 at 4:27
  • @DaleM he said prosecutors, so I told him how a prosecutor would look at it. – Putvi May 8 at 15:44
5

As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (OTP or pad) is correct. That does not mean that there is no way to prove such a decryption accurate to the satisfaction of a court of law.

If the storage or transmission of the pad is compromised, analysts may have and know that they have the correct text of the pad. If use of this pad results in a valid, plausible clear-text, as opposed to random gibberish, that would be significant corroboration. For while it is true that a false pad can be intentionally created to have any decryption result desired, this would not be plausible unless the users of the OTP knew that their pad was being sought, knew how it was being compromised, and intentionally substituted a fake pad without the investigators discovering this.

If a party to the encryption cooperates and delivers a copy of the actual pad, then it is just a question of the credibility of that witness -- no different really than if such a person had retained a copy of the cleartext before it was encrypted or after it was decrypted.

If the method for generating pads was compromised, and the recovered pads resulted in plausible cleartexts for many messages, that might well be plausible evidence.

In short, if a credible witness or expert claims to have the correct pad, the testimony would probably be admissible, although subject to challenge and rebuttal. There would not be an absolute rule against such evidence, but it would have to meet the same "reasonable doubt" standard (if in a criminal case) or other relevant standard (in a civil case) as any other evidence or testimony.

  • "this would not be plausible unless -..." Yes but as explained it is entirely plausible the key be engineered and the evidence manufactured as it is a relatively trivial process. The attack vector was not the defendant but the prosecution doing so, which could easily be done. Given that anybody can manufacture the evidence as such does that not make the 'evidence' produced by itself, null and void and failing the reasonable doubt test, given that anybody could have manufactured this? – Reality May 8 at 12:19
  • 2
    @Reality That's no different than literally any other evidence. It comes down to the authenticity of the evidence, which is something courts have dealt with since approximately the invention of the concept of "evidence." – cpast May 8 at 15:39
4

Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it is better to think of it as spliting in two. If the prosecution finds both pieces and can tie them to you, then they have a good evidence against you. Both parts belonged to you and they give a sensible output, hence you probably wrote it.

This is similar to the prosecution just finding a plaintext file. The file could be edited or created by anyone, but because it is on your computer, it may be used against you, especially if the computer is password protected. In the end, it is up to the jury to decide if you wrote it.

On the other hand, if the prosecution only finds one piece, it is indeed useless as evidence.

  • 1
    Although this doesn't answer the question, this is actually rather useful. It is actually rather true, it is less 'encryption', though technically that is its term. In a legal sense I assume encryption would be that which could technically (however hard) be 'cracked', therefore a proof can be given. In this sense you have actually given a good insight, as this is technically just the storing of jumbled up data, and unlike 'traditional' encryption, this mechanism actually makes data indepdendent and useless without true knowledge of both 'data sets' (key and cipher). An interesting insight. – Reality May 8 at 12:24
1

That's an interesting question. Because of the way OTPs work, you can supply an carefully selected arbitrary key to get any output you desire. See below for explanation.

XOR is a commutative algorithm. Meaning that:

ct=m1xork1

enter image description here

Now if you supply a K(2) to the same CT you will now get something like:

M(2) = CT ^ K(2)

Meaning that because the selected key directly influences the message decryption at the byte level, you can select a key by computing:

enter image description here

K(2) will now decrypt the original ciphertext into the arbitrarily selected message. So to answer your question, if all properties of the OTP are maintained correctly, it should be inadmissible because there's no way to prove that the K(2) == K(1). Consequentially, there's no way to prove the integrity of the message.

  • What is the legal basis for your assertion as it pertains to the rules of evidence? – Xander May 7 at 22:29
  • Well, I read part of that paper you wrote. I've testified in court as a cyber security expert before, and I'm just telling you what I think. I can't say for sure as I'm not a lawyer, but due to the fact that it's logistically impossible to prove the integrity of a message encrypted with OTP without knowing the original key, I feel like it could easily be proven inadmissible via a simple example of the problem. I'd encrypt a message with K(1), select an arbitrary message and calculate K(2) to show that it's possible to choose a key that will decrypt the message into anything I want it to be. – leaustinwile May 7 at 22:32
  • In court you have to prove the integrity of your evidence and show that it isn't forged, fraudulent and hasn't been altered. Without proof of the original keys and their data, you can't prove that the message decryption being shown to the court is accurate. Any crypto/security specialist will be able to demonstrate this in a court room. Given these conditions, I think it's safe to assume that it can make that data inadmissible. It comes down to the burden of proof. The state has to prove that that their evidence directly incriminates the defendant and they have to prove the integrity upon – leaustinwile May 7 at 22:34
  • 2
    That's different than inadmissibility. – Xander May 7 at 22:37
  • the challenging of that evidence. – leaustinwile May 7 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.