nihilist@mainpc - 2024-05-01

What is Plausible Deniability ? Why is it Important ?

Encryption Provides Privacy

Let's take our previous analogy to explain what Privacy is:

Bob wants to talk to Alice, He wants the conversation to remain private, so he closes the door
Jack can't spy on bob and alice's conversation, because the door is closed, 
The door is closed, the conversation remains between Alice and Bob, their conversation is Private.
	

For Alice and Bob to protect their conversation from being spied on by Jack, they encrypt their conversation for example by using PGP.

Here the most common usecase for encryption is for people to encrypt their system disk on their computers, because if someone (like jack) were to steal their computer, they don't want to read all of their data.

All in all, encryption is used to provide privacy. As long as the encrypted volumes are closed when Jack is trying to open them, Jack cannot read the contents of the volumes.

What happens when Bob is forced to give out his password ?

Encryption however, cannot protect against everything.

In this case, Bob is legally, although questionably morally, forced to decrypt his encrypted system disk by the judge. Keep in mind that this is not a far fetched scenario, this has happened previously.

1. in January 2012 (source)

2. in Febuary 2009 (source)

Now here there are multiple scenarios. Either you live in a country that doesn't respect human rights, and they torture you until you spit out the password, or the country you live in has to respect human rights, they throw you in jail for let's say 6 months, for contempt of court (arguing that you swore to tell the truth, and you lied about having forgotten your password), which is also an attempt to break your will, to make you spit out the password. the only problem is that they can't legally torture you any other way, so they have no other option than to do it like that.

If you are ever dragged into court, the judge will appreciate much more if you actually hand over your laptop, and show that you are willing to cooperate with the authorities by providing your password to unlock it, rather than starting to pretend you forgot your password (which can end badly like in this court case, where the defendant was found to be in contempt of court, and thrown in jail for 6 months for it),

When that is the case, simply encrypting the disk is not enough, as all that is required is for the adversary to know of the existance of the encrypted drive, to be able to force Bob to open it

As far as key encryption laws, the trend is that most developed countries are forcing their citizens to incriminate themselves and to surrender the encryption keys to authorities, when asked. In short,If the encrypted volume is proven to exist, you can be forced to surrender the decryption key/password to open it.

Why is Plausible Deniability is Vital?

From a legal standpoint, the only way to be protected against that scenario where you're forced to decrypt your harddrive is to be able to deny the existence of said encrypted volume (Plausible Deniability) . If the encrypted volume does not exist, there is no password to be given for it.

So here we need a technology that can provide us Plausible Deniability. That is what Veracrypt can do for us.

In short, Veracrypt allows you to encrypt volumes, just like LUKS encryption does. However it gives you the choice to hide another encrypted volume inside the same volume, that is exactly what you can deny the existence of.

So you can hide some random meaningless data inside the decoy volume, while the real data that needs protection sits inside the hidden volume.

This means, when Jack forces Bob to open the vercrypt volume, Bob types Password A to open the decoy volume, Then, when asked by Jack, Bob declares that there is no Hidden volume, and Jack has no way to prove the existence the Hidden Volume.

To see how to implement Plausible Deniability protection with Veracrypt, check out this tutorial.