View source for Rubber-hose cryptanalysis

{{short description|Extraction of cryptographic secrets by coercion or torture}}

In [[Cryptography|cryptography]], '''rubber-hose cryptanalysis''' is a [[Social:Euphemism|euphemism]] for the extraction of cryptographic secrets (e.g. the password to an encrypted file) from a person by [[Social:Coercion|coercion]] or [[Philosophy:Torture|torture]]<ref>{{cite web |url=http://www.schneier.com/blog/archives/2008/10/rubber_hose_cry.html |title=Rubber-Hose Cryptanalysis |first=Bruce |last=Schneier |date=October 27, 2008 |work=Schneier on Security |access-date=August 29, 2009}}</ref>—such as beating that person with a rubber hose, hence the name—in contrast to a mathematical or technical [[Cryptanalysis|cryptanalytic attack]].

== Details ==

According to Amnesty International and the {{wipe|United Nations}}, many countries in the world routinely torture people.<ref>{{cite journal |url=http://www.thelancet.com/journals/lancet/article/PIIS0140-6736(03)14730-7/fulltext |title=Exposing the horror of torture |first=Stephen |last=Pincock |journal=The Lancet |volume=362 |issue=9394 |pages =1462–1463 |date=November 1, 2003 |doi=10.1016/S0140-6736(03)14730-7 |access-date=August 29, 2009 |pmid=14603923|s2cid=54239764 }}</ref><ref name="UN_2004_10_27">{{cite press release|url=https://www.un.org/apps/news/story.asp?NewsID=12364&Cr=torture |title=Many countries still appear willing to use torture, warns UN human rights official |publisher={{wipe|United Nations}} News Service |date=October 27, 2004 |access-date=August 28, 2009}}</ref><ref>{{cite journal |url=http://www.thelancet.com/journals/lancet/article/PIIS0140-6736(00)03218-9/fulltext |title=Torture and trauma in post-conflict East Timor |journal=The Lancet |volume=356 |issue=9243 |page=1763 |date=November 18, 2000 |doi=10.1016/S0140-6736(00)03218-9 |first1=J. |last1=Modvig |first2=J. |last2=Pagaduan-Lopez |first3=J. |last3=Rodenburg |first4=CMD |last4=Salud |first5=RV |last5=Cabigon |first6=CIA |last6=Panelo |archive-url=https://web.archive.org/web/20110608081958/http://www.thelancet.com/journals/lancet/article/PIIS0140-6736(00)03218-9/fulltext |archive-date=June 8, 2011 |access-date=August 29, 2009 |pmid=11095275 |s2cid=43717344 }} [http://members.pcug.org.au/~wildwood/Lancet.htm Alt URL] {{Webarchive|url=https://web.archive.org/web/20221105211146/http://members.pcug.org.au/~wildwood/Lancet.htm |date=2022-11-05 }}</ref><ref>{{cite journal |url=http://www.thelancet.com/journals/lancet/article/PIIS0140-6736(05)65892-8/fulltext |title=Turkish physicians coerced to conceal systematic torture |  first=Vincent |last=Iacopino |journal=The Lancet |volume=348 |issue=9040 |page=1500 |date=November 30, 1996 |doi=10.1016/S0140-6736(05)65892-8 |access-date=August 29, 2009 |pmid=11654536|s2cid=20335366 }}</ref> It is therefore logical to assume that at least some of those countries use (or would be willing to use) some form of rubber-hose cryptanalysis.  In practice, [[Social:Coercion#Psychological|psychological coercion]] can prove as effective as physical [[Philosophy:Torture|torture]]. Not physically violent but highly intimidating methods include such tactics as the threat of harsh legal penalties. The incentive to cooperate may be some form of [[Social:Plea bargain|plea bargain]], such as an offer to drop or reduce criminal charges against a suspect in return for full co-operation with investigators. Alternatively, in some countries threats may be made to prosecute as co-conspirators (or inflict violence upon) close relatives (e.g. spouse, children, or parents) of the person being questioned unless they co-operate.<ref name="UN_2004_10_27"/><ref>{{cite web |url=http://www.animatedsoftware.com/hightech/philspgp.htm |title=Interview with author of PGP (Pretty Good Privacy) |date=February 2, 1996 |first=Russell D. |last=Hoffman |work=High Tech Today |access-date=August 29, 2009}}</ref>

In some contexts, rubber-hose cryptanalysis may not be a viable attack because of a need to decrypt data covertly; information such as a password may lose its value if it is known to have been compromised.  It has been argued that one of the purposes of strong cryptography is to force adversaries to resort to less covert attacks.<ref>{{cite web |url=http://www.bsdcan.org/2010/schedule/attachments/135_crypto1hr.pdf |title=Everything you need to know about cryptography in 1 hour (conference slides) |date=May 13, 2010 |first=Colin |last=Percival |access-date=December 29, 2011}}</ref>

The earliest known use of the term was on the sci.crypt newsgroup,{{Citation needed|reason=No evidence cited that this use was the first known use of the term|date=February 2014}} in a message posted 16 October 1990 by Marcus J. Ranum, alluding to corporal punishment:

{{quote|...the rubber-hose technique of cryptanalysis. (in which a rubber hose is applied forcefully and frequently to the soles of the feet until the key to the cryptosystem is discovered, a process that can take a surprisingly short time and is quite computationally inexpensive).<ref>{{cite newsgroup |url=http://groups.google.com/group/sci.crypt/msg/86404637e708d900?pli=1 |title=Re: Cryptography and the Law... |first=Marcus J. |last=Ranum |newsgroup=sci.crypt |message-id=1990Oct16.050000.4965@decuac.dec.com |date=October 16, 1990 |access-date=October 11, 2013}}</ref>}}

Although the term is used tongue-in-cheek, its implications are serious: in modern [[Cryptosystem|cryptosystems]], the weakest link is often the human user.<ref>{{cite web|url=http://www.sans.org/reading_room/whitepapers/vpns/weakest-link-human-factor-lessons-learned-german-wwii-enigma-cryptosystem_738|title=The Weakest Link: The Human Factor Lessons Learned from the German WWII Enigma Cryptosystem|publisher=SANS|access-date=6 June 2013}}</ref> A direct attack on a cipher algorithm, or the [[Cryptographic protocol|cryptographic protocol]]s used, is likely to be much more expensive and difficult than targeting the people who use or manage the system. Thus, many cryptosystems and security systems are designed with special emphasis on keeping human vulnerability to a minimum. For example, in [[Public-key cryptography|public-key cryptography]], the defender may hold the key to encrypt the message, but not the decryption key needed to decipher it. The problem here is that the defender may be unable to convince the attacker to stop coercion. In plausibly [[Deniable encryption|deniable encryption]], a second key is created which unlocks a second convincing but relatively harmless message (for example, apparently personal writings expressing "deviant" thoughts or desires of some type that are lawful but taboo), so the defender can prove to have handed over the keys whilst the attacker remains unaware of the primary hidden message. In this case, the designer's expectation is that the attacker will not realize this, and forego threats or actual torture. The risk, however, is that the attacker may be aware of deniable encryption and will assume the defender knows more than one key, meaning the attacker may refuse to stop coercing the defender even if one or more keys are revealed, on the assumption the defender is still withholding additional keys which hold additional information.

== In law ==

In some jurisdictions, statutes assume the opposite—that human operators know (or have access to) such things as session keys, an assumption which parallels that made by rubber-hose practitioners. An example is the United Kingdom's Regulation of Investigatory Powers Act,<ref name="Guardian Q&As">{{cite news| url=https://www.theguardian.com/world/2000/oct/24/qanda | location=London | work={{wipe|The Guardian}} | title=The RIP Act | date=October 25, 2001}}</ref><ref name="RIP online">{{cite web|url=http://www.parliament.the-stationery-office.co.uk/pa/ld199900/ldbills/061/2000061.htm|title=Regulation of Investigatory Powers Bill; in Session 1999-2000, Internet Publications, Other Bills before Parliament|publisher=House of Lords|date=9 May 2000|access-date=5 Jan 2011|url-status=dead|archive-url=https://web.archive.org/web/20111108020103/http://www.parliament.the-stationery-office.co.uk/pa/ld199900/ldbills/061/2000061.htm|archive-date=8 November 2011}}</ref> which makes it a crime not to surrender [[Key (cryptography)|encryption keys]] on demand from a government official authorized by the act.

According to the Home Office, the burden of proof that an accused person is in possession of a key rests on the prosecution; moreover, the act contains a defense for operators who have lost or forgotten a key, and they are not liable if they are judged to have done what they can to recover a key.<ref name="Guardian Q&As"/><ref name="RIP online"/>

==Possible case==
In the lead-up to the 2017 Kenyan general election, the head of information, communication, and technology at the Independent Electoral and Boundaries Commission, Christopher Msando, was murdered. He had played a major role in developing the new voting system for the election. His body showed apparent marks of torture, and there were concerns that the murderers had tried to get password information out of him.<ref>{{cite news|last1=David Pilling|title=Ghost of Chris Msando haunts Kenyan election|url=https://www.ft.com/content/1cfa53ae-7e7a-11e7-9108-edda0bcbc928 |archive-url=https://ghostarchive.org/archive/20221210/https://www.ft.com/content/1cfa53ae-7e7a-11e7-9108-edda0bcbc928 |archive-date=2022-12-10 |url-access=subscription |url-status=live|work=Financial Times|date=Aug 11, 2017}}</ref>

==In popular culture==
* A well-known xkcd comic ([https://xkcd.com/538/ xkcd 538: Security]) describes the issue.  In the first panel a crypto nerd imagines that due to his advanced encryption (4096-bit [[RSA (cryptosystem)|RSA]]), the crackers will be ultimately defeated, despite having access to million-dollar hardware. In the second panel, the people with the desire to access this information use a five-dollar wrench and torture to coerce the nerd to give them the password.<Ref>Bruce Schneier.  [https://www.schneier.com/blog/archives/2009/02/xkcd_on_cryptan.html xkcd on Cryptanalysis]</ref>

==See also==
{{div col}}
* {{annotated link|Black-bag cryptanalysis}}
* {{annotated link|Deniable encryption}}
* {{annotated link|Social:Social engineering (security)|Social engineering}}
* {{annotated link|Software:Rubberhose (file system)|Rubberhose}} (encrypted filesystem)
{{div col end}}

==References==
{{Reflist}}

==External links==
* [https://onezero.medium.com/rubber-hoses-fd685385dcd4 The Best Defense Against Rubber-Hose Cryptanalysis], by Cory Doctorow

[[Category:Cryptographic attacks]]

{{Sourceattribution|Rubber-hose cryptanalysis}}