In the documentary film Citizenfour, Edward Snowden says about documents:
I'm comfortable in my technical ability to protect [documents]. I mean you could literally shoot me or torture me and I could not disclose the password, even if I wanted to. I have the sophistication to do that.
What technology/methods exist that would enable the scenario Edward Snowden is referring to when he claims to be able to create a protected file where he cannot disclose the password?
Shamir's Secret Sharing is a method for this. It allows one to encrypt a file with a public / private keypair, and then effectively split up the parts of the private key to be distributed to several different people. After that action (and assuming the various parts and original input private key are destroyed after distribution), it would require a quorum of people to act together in order to decrypt the data.
All of our answers are speculation, of course, but I suspect that the most likely way that the documents are protected are by following Bruce Schneier's advice regarding laptop security through airports:
Step One: Before you board your plane, add another key to your whole-disk encryption (it'll probably mean adding another "user") -- and make it random. By "random," I mean really random: Pound the keyboard for a while, like a monkey trying to write Shakespeare. Don't make it memorable. Don't even try to memorize it.
Technically, this key doesn't directly encrypt your hard drive. Instead, it encrypts the key that is used to encrypt your hard drive -- that's how the software allows multiple users.
So now there are two different users named with two different keys: the one you normally use, and some random one you just invented.
Step Two: Send that new random key to someone you trust. Make sure the trusted recipient has it, and make sure it works. You won't be able to recover your hard drive without it.
Step Three: Burn, shred, delete or otherwise destroy all copies of that new random key. Forget it. If it was sufficiently random and non-memorable, this should be easy.
Step Four: Board your plane normally and use your computer for the whole flight.
Step Five: Before you land, delete the key you normally use.
At this point, you will not be able to boot your computer. The only key remaining is the one you forgot in Step Three. There's no need to lie to the customs official; you can even show him a copy of this article if he doesn't believe you.
Step Six: When you're safely through customs, get that random key back from your confidant, boot your computer and re-add the key you normally use to access your hard drive.
And that's it.
This is by no means a magic get-through-customs-easily card. Your computer might be impounded, and you might be taken to court and compelled to reveal who has the random key.
To be even more secure, Snowden himself may not know who has the backup key--as the associate he gave it to may have passed it along elsewhere. Also, it is likely that the person that did receive the backup key from Snowden is in a different country than any likely attacker and is doing his or her best to stay very safe.
EDIT: In response to the below comment, I decided to add the following advice:
Create a dummy operating system that starts at the beginning of the laptop's hard drive. The encrypted operating system with sensitive information will be the following partition. Configure the laptop's bootloader to boot from the dummy operating system without your intervention.
TrueCrypt had a similar hidden operating system feature where the TrueCrypt bootloader would accept two different passwords, giving access to two different operating systems. The hidden operating system was concealed with a bit of clever steganography.
We can do something similar in Linux and LUKS, but without the steganography, by doing the following:
Step four is not very user friendly, and we could get rid of it and make a separate bootloader entry for our secret operating system, but then anybody that looked at the screen could tell that there are two operating systems on the machine. An investigator can still tell, but now they must look at the laptop's hard drive with a partition editing tool.
Here is an original technique I have come up with that can survive a rubber-hose attack:
You don't have to use cash, either; your password could be embedded in the order of the books on your bookshelf, or some other ephemeral thing that will most likely be destroyed by government agents in a search. But cash has the advantage of being much more likely to vanish completely in a search.
He might be referring to neuroscientific methods of cryptographic primitives such as those outlined in the following paper: https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final25.pdf
Basically, you can prevent against "rubber hose attacks" as they call it (torture the password out of somebody) by training the user via some sort of game or app that subconsciously plants the password (combination of moves to accomplish a goal, for example) using implicit learning. The user can use the password, though cannot recall it outside of the situation of playing the game.
Think, for instance, moves you memorize in Pac-Man or Mario when you play the same level over and over... you get "good" at it because you are practicing the same movements repeatedly to accomplish the goal, even though if I sat you down with a game controller in an empty room (no game, no screen), you wouldn't (easily) be able to replicate the pattern.
I'm not sure if that is what Snowden is referring to, but it's one possibility.
key is not necessarily how you play the game but rather the game itself. For instance, I can demonstrate how to swim but I cannot explain (in significant detail) how I learned how to swim. The process of learning (or the game) is the key -or rather contains the key, because a user will subconsciously inherit the item being taught and it is that subconscious level where the 'password' is stored in your brain. Bare in mind that this paper is a mere conceptual approach and not necessarily a ready to implement design...
– Matthew Peters
Mar 04 '15 at 21:53
Keyfiles can almost accomplish this. The idea is the encryption key is stored as a file rather than a phrase the user memorizes. Keepass/KeepassX offers keyfiles as an option for securing the password database instead of a passphrase. The key can be more secure because it can be of much longer length than something a human needs to use, but the downside is that file must be protected from other parties gaining access. Typically these files are stored on a USB drive or other external media, or could possibly be held by a third party or otherwise outside your possession. This may not solve your problem though, since you may be tortured to reveal the location of the keyfile.
Other options are encryption that requires more than one person to be party during the process (again, could be tortured to reveal the other people involved), deniable encryption, and verifiable destruction. The latter two are discussed here. All of these have their own unique set of problems though.
I haven't seen the documentary, but in addition to what others have spoke about, he could be talking about public/private key encryption.
You encrypt a file with the public key provided by an anonymous third party who shares your view. Only they can decrypt the file, and you don't know who they are.
So he has a document, encrypt it so it is protected and no matter how much you torture him he would never be able to decrypt it for you.
If Snowden did this, he would lose the ability to decrypt his documents, but that is a relatively small price to pay. Presumably, he already knows what is in the documents, and he stole them for others to decrypt.
– James Mishra Mar 05 '15 at 00:19
you could literally shoot me[him] or torture me[him] and I[he] could not disclose the password, even if I[he] wanted to
– DoubleDouble
Mar 05 '15 at 22:11
While I haven't seen the film, I can easily imagine a randomly generated passcode which changes every [brief time window here]. Some online gaming security protocols started doing this a couple years ago, such as Battle.net (Blizzard - games like World of Warcraft, Starcraft, Diablo)
Add in the fact that you can only get the most recent passcode from a selected secure device and then he can't know what the current passcode is without that device.
As an extreme example, his phone may have encrypted files, but is not able to decrypt them without the passcode provided from the secure device [similar to @DavidJacobson's answer] - in this case a combination of people or computers in different locations [@JeffFerland's answer] which each have their own section of the passcode. If one person or computer is attacked, the others can be disconnected or moved - depending on the situation.
The weakest point is then the process for requesting the decrypt key. Assuming a person is qualified to have access to that file, they may have to provide physical identification. Perhaps they only have access to the decrypted file if they are in a specific location.
Sure, all this could ultimately be overcome, but the point is that it would be incredibly difficult. Let's say you capture someone with the file and try to get the key from them only to find out that it can only be gotten from someone else, and only while they are inside a guarded building, plus they can't physically take the information out with them. What would be your approach after that?
In the end, I can't imagine the information that is on this file to make it worth so much effort. The more truly valuable the information is, the less people that will have access to it, and those people are likely in higher positions of power, therefore they are more likely to be protected or at least noticed missing if they get kidnapped.
There are very interesting answers there. One warning though: I was once offered to access the ATM of my bank account via a finger scan instead of the typical PIN. I refused. The bank was then assuring me that they guarantee that a copy of my fingerprint cannot be used (yeah, it was a few years ago)
I then told them that I am not sure that the bad guys know this and I very, very much prefer to rather give them the PIN than my thumb.
This is to say that the rubber hose users may not be aware of the subtle techniques used to not know the password.
I think the only way how you actually can decrypt it now, but not when being tortured is if you either have the chance to destroy/forget the key before you can be made to reveal it. Or the key has a property which makes it unusable in a tortured situation.
Many answers address only the part, where you "can not reveal the key to the evil guy, even if you wanted to" - but with some whistle-blower I think a usable system would also have to give you a way how to access the information if you need it, before or even after they got to you.
Maybe you have a system where you can only enter the key if you are calm and relaxed. A sophisticated speech analysis software? Or maybe just an anonymous third party. - If only a third party has the key one scheme would be this: You have to post a video of yourself where you kindly request the key in a calm and controlled manner, standing in a public space or something. You post it somewhere where it gets a lot traffic like youtube/twitter. The anonymous source will access the video (among thousands of viewers) and if he believes you are safe and your voice sounds controlled and everything, he sends you the decrypted documents.
Maybe the key self-destructs under certain circumstances, like physiological signs of extreme stress, like biting you teeth or extreme heart-rate. As soon as torture comes into play the key will be gone.
There are shared key principles where you need a certain amount of people together to decrypt something - you could employ one, where you split the key in a way where you need at least 3 of 5 people to decrypt it. But then still, if you have a way to contact the other people of this group, you can probably be forced to contact them, so it all boils down to solution 1, where your communication with them needs to be good enough, so they can make sure if you are forced to do it or do it willingly.
It might refer to having multiple possible decryption states. Basically, you start with an extra-large blob of encrypted data, and multiple keys. Each key results in a different document.
Obviously, the encrypted data needs to be large enough to hold all documents, but there's no way to prove how many keys exist. Make it large enough to hold 10 documents, for example, and you could have 2 false keys, one real key, and a bunch of random data.
I'm going a little sci-fi with this answer.
Smart cards, even contactless ones are powerful enough to do cryptography. They often contain a private key, which was generated by them and never leaves the card, but the corresponding public key can be retrieved freely. These smart cards can be protected with a password, they can make themselves inoperable after 3 failed tries, etc. They are uncloneable and extremely secure. (Also, they are tiny, they're a tiny chip within a plastic card, and they consume only a tiny amount of energy.)
You could then encrypt a document, a whole hard drive or whatever using a random key, then encrypt the key with the smart card's public key and save only that. This way, if you want access to the encrypted data, you first have to ask the smart card to decrypt the key using its internal private key.
Now we just have to tie the card to Snowden in a way that ensures that
A straightforward option is implanting the card (only the chip, not the plastic part) into him. It could feed on the voltage generated by his body while inactive (e.g. his heart and/or muscles output a few millivolts constantly) and disable itself if this power is cut. You could also wire it up to some of his voluntary muscles which, if activated in a certain pattern could enable or destroy the card. If we want to go deeper into this sci-fi, you could have the card check if his heart rate and/or epinephrine level is below a certain threshold and deny operation temporarily when he is under excessive stress. It would have an antenna in a convenient place, possibly his palm, to communicate using NFC or something similar.
If the power supplied by his body isn't enough, another option would be to implant it along with a battery. It could be a pacemaker-like device. Pacemakers have an internal battery which lasts for years. It could do anything the previously described implant does. (It could be a pacemaker/ICD too, for preventive purposes - It's not unheard of for important people to have a defibrillator in their home and their family trained to use it.) An alternative idea would be to have a regular contactless smart card in his front pocket that feeds off of this pacemaker-like device continuously using the same principle as NFC and disables itself permanently if power is cut for more than a minute. This NFC power could also carry cryptographical data to be unique and unreplicable.
