{"id":6325,"date":"2018-04-25T14:00:51","date_gmt":"2018-04-25T18:00:51","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=6325"},"modified":"2019-05-08T11:51:47","modified_gmt":"2019-05-08T15:51:47","slug":"gdpr-encryption-best-practices-wp29","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/gdpr-encryption-best-practices-wp29\/","title":{"rendered":"GDPR: Encryption Best Practices \u2013 No Backdoors"},"content":{"rendered":"\n

The Article 29 Working Parting has released new guidance on encryption standards<\/h2>\n\n\n\n

The EU\u2019s General Data Protection Regulation (GDPR) goes into effect in exactly one month on May 25th<\/sup>. That\u2019s in 20 business days. Hopefully you\u2019ve been staying on top of everything by keeping up with our GDPR Compliance series<\/a>. Today, we\u2019re going to discuss new guidance on Encryption standards that was issued by the Article 29 Data Protection Working Party on April 11<\/a>.<\/p>\n\n\n\n

At issue is request from numerous parties, namely law enforcement in this case, to weaken encryption by including workarounds and backdoors that would enable the authorities to decrypt information more readily. Let\u2019s Hash it out.<\/span><\/p>\n\n\n\n

The argument for encryption backdoors<\/h2>\n\n\n\n

This is a topic we\u2019ve covered quite a bit here on Hashed Out. If you\u2019ll remember, just last month the final approval of TLS 1.3 by the IETF was temporarily delayed by an 11th<\/sup> hour request from the financial industry to insert an encryption backdoor for the sake of traffic inspection. That attempt was rebuffed, but it was really just the latest in a long line of requests to undermine encryption.<\/p>\n\n\n\n

While the issue predates it, the terrorist attack in San Bernardino, California that killed 14 people kicked off the current iteration of the debate. The FBI fought publicly with Apple over its inability to unlock one of the terrorists\u2019 iPhones. At a December 9, 2015 Senate Judiciary Committee hearing<\/a>, then-FBI Director James Comey called for a \u201csolution\u201d to allow government access, but that didn\u2019t weaken security.<\/p>\n\n\n\n

That was obviously a ridiculous ask, as such a backdoor would definitely weaken encryption. But that hasn\u2019t stopped the leaders of law enforcement, along with political leaders in both the US and the UK from continuing to ask. In the UK, the brain trust in the Conservative Party, which let the encryption on its own website lapse last year<\/a>, has called for everything from backdoors to an outright ban on encryption.<\/p>\n\n\n\n

Fortunately, the Article 29 Data Protection Working Party has said bollocks to that and has come out with guidance on encryption that makes no bones about the fact that it should not be weakened for law enforcement or anyone else.<\/p>\n\n\n\n

Article 29 Data Protection Working Party Guidance on Encryption<\/h2>\n\n\n\n

While WP29 attempted to find a balance between the needs of law enforcement and the rights of individuals to strong security, it came out on the side of the individuals.<\/p>\n\n\n\n

\u201cThe availability of strong and efficient encryption is a necessity in order to guarantee the protection of individuals with regard to the confidentiality and integrity of their data which are the elementary underpinning of the digital economy. Any obligation aiming at reducing the effectiveness of those techniques in order to allow law enforcement access to encrypted data could seriously harm the privacy of European citizens.\u201d<\/p><\/blockquote>\n\n\n\n

To that end, the Article 29 Working Party has communicated the following points regarding encryption standards:<\/p>\n\n\n\n

Strong encryption is required to ensure a secure, free flow of data between citizens, businesses and governments<\/h2>\n\n\n\n

WP29 begins by extoling the virtues of encryption, noting that it is necessary to offer a \u201creasonable guarantee\u201d when performing most online activities such as banking, filing taxes, corresponding via email or making an appointment with a physician. Without encryption in place, any information shared in the process of performing said activities would be vulnerable to eavesdropping.<\/p>\n\n\n\n

In the eyes of WP29, and by extension with regard to the GDPR, encryption is viewed as \u201cabsolutely necessary and irreplaceable for guaranteeing strong confidentiality and integrity when data are transferred across open networks like the internet, or stored in mobile devices like smartphones.\u201d<\/p>\n\n\n\n

\u201cThis encryption should ideally always cover the entire communication, from the device of the sender to that of the recipient (end to-end-encryption).\u201d<\/p><\/blockquote>\n\n\n\n

Additionally, in order for your encryption to be considered dependable WP29 promotes the \u201cbroadest public availability of state of the art, strong and reliable encryption\u2026 for public scrutiny.\u201d By doing this, it allows researchers to assess and improve its efficiency and robustness, which is good for the entire ecosystem. WP29 also advises that quantum cryptography be considered as it becomes more viable.<\/p>\n\n\n

\n\t\t\t\n\t\t<\/a>\n\t\t
\n\t\t

\n\t\t\tHow strong is 256-bit Encryption?<\/a>\n\t\t<\/p>\n\t\t

\n\t\t\t\n\t\t\t\t\t\t\t\t\t In Everything Encryption <\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t By Patrick Nohe <\/span>\n\t\t\t\t\t\t\t<\/em>\n\t\t<\/p>\n\t\t

\n\t\t\t

\n\t\t\t\t

256-bit encryption strength gets tossed around all the time, but most people have no idea what 256 bits of security means or how strong it actually is. Let’s hash it out.<\/p>\n\t\t\t<\/p>\n\t\t<\/div>\n\t\t

\n\t\t\t\n\t\t\t\tRead more\t\t\t<\/a>\n\t\t<\/p>\n\t<\/div>\n<\/div>\n\n\n\n

Backdoors and master keys deprive encryption of its utility and cannot be used in a secure manner<\/h2>\n\n\n\n

While WP29 concedes that encryption can be used to conceal the activities of criminals, and that there is a need for law enforcement to have access to suspected criminals\u2019 data, it argues that \u201cthe mathematical foundation for cryptology does not provide the basis for a secure backdoor.\u201d<\/p>\n\n\n\n

It also provides three high-profile examples that show master keys and backdoors \u201ccannot be kept secure.\u201d<\/p>\n\n\n\n