3

Under the Regulation of Investigatory Powers Act 2000 Part III Section 49 the police can, with a certain procedure, require one to provide a key with threat of custodial sentence up to 2.5 years if deigned.

However there is a specific exception in part (9): A notice under this section shall not require the disclosure of any key which (a)is intended to be used for the purpose only of generating electronic signatures; and (b)has not in fact been used for any other purpose.

It seems therefore that a relatively easy solution if one was concerned about having to reveal potentially incriminating information would be to regenerate your keys every time you need them. According to this answer it is possible to build a deterministic PGP key generator. The seed that is provided to this would be a key that is intended for the purpose only of generating electronic signatures and has not in fact been used for any other purpose, which would appear to exempt it from required disclosure. This key could then be used to encrypt / decrypt any sensitive data, and disposed of when finished.

Would such a scheme protect against being required to provide access to such sensitive data?

Improve this question
4
  • 3
    The seed in your example does not seem to meet the requirements of part 9, because it has been (intentionally) used to generate encryption and decryption keys, which is a different purpose than generating electronic signatures.
    – Nate Eldredge
    Mar 21, 2021 at 17:17
  • You could only use it to create signatures (gnupg.org/gph/en/manual/x135.html), and then use those as a key?
    – Rod
    Mar 21, 2021 at 17:22
  • 4
    I would expect that whether a particular string of bits is considered an "electronic signature" would be defined by how you actually (intend to) use it, rather than just how the software designers intended it to be used. You might have to see if there is a definition elsewhere in the law, or see if courts have considered similar cases before.
    – Nate Eldredge
    Mar 21, 2021 at 18:27
  • 1
    Courts tend to have a special love for schemes specifically designed to thwart judicial proceedings... Watch out for that.
    – user28517
    Mar 21, 2021 at 21:15

1 Answer 1

Reset to default
2

A key to a box containing a key to another box is still a key

Similarly, a password that generates a password that gives access to your data is still a password, even if the intermediate password can (also) be used as a digital signature.

The problem with your plan is that it starts with the basic assumption that courts are stupid and only apply the literal meaning of the words rather than, as they actually do, apply intelligence to determine how the intent of the law applies to the particular facts.

Improve this answer
1
  • This. There is a reason why judges, lawyers, prosecutors, and jurors are humans, not computers.
    – Jörg W Mittag
    Mar 22, 2021 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .