1

Under the Regulation of Investigatory Powers Act 2000 Part III Section 49 the police can, with a certain procedure, require one to provide a key with threat of custodial sentence up to 2.5 years if deigned.

However there is a specific exception in part (9): A notice under this section shall not require the disclosure of any key which (a)is intended to be used for the purpose only of generating electronic signatures; and (b)has not in fact been used for any other purpose.

It seems therefore that a relatively easy solution if one was concerned about having to reveal potentially incriminating information would be to regenerate your keys every time you need them. According to this answer it is possible to build a deterministic PGP key generator. The seed that is provided to this would be a key that is intended for the purpose only of generating electronic signatures and has not in fact been used for any other purpose, which would appear to exempt it from required disclosure. This key could then be used to encrypt / decrypt any sensitive data, and disposed of when finished.

Would such a scheme protect against being required to provide access to such sensitive data?

4
  • 2
    The seed in your example does not seem to meet the requirements of part 9, because it has been (intentionally) used to generate encryption and decryption keys, which is a different purpose than generating electronic signatures. Mar 21 at 17:17
  • You could only use it to create signatures (gnupg.org/gph/en/manual/x135.html), and then use those as a key?
    – Rod
    Mar 21 at 17:22
  • 4
    I would expect that whether a particular string of bits is considered an "electronic signature" would be defined by how you actually (intend to) use it, rather than just how the software designers intended it to be used. You might have to see if there is a definition elsewhere in the law, or see if courts have considered similar cases before. Mar 21 at 18:27
  • 1
    Courts tend to have a special love for schemes specifically designed to thwart judicial proceedings... Watch out for that.
    – Moo
    Mar 21 at 21:15
2

A key to a box containing a key to another box is still a key

Similarly, a password that generates a password that gives access to your data is still a password, even if the intermediate password can (also) be used as a digital signature.

The problem with your plan is that it starts with the basic assumption that courts are stupid and only apply the literal meaning of the words rather than, as they actually do, apply intelligence to determine how the intent of the law applies to the particular facts.

1
  • This. There is a reason why judges, lawyers, prosecutors, and jurors are humans, not computers. Mar 22 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.