GCHQ Developed Encryption Software ‘Has Backdoor’

A security researcher has claimed there is a backdoor that will allow undetectable mass surveillance in a piece of software written by GGHQ used to encrypt Voice Over Internet Protocol (VoIP) calls.

The claims of a backdoor were made by Dr Steven Murdoch, a Principal Research Fellow at University College London’s Information Security Research Group, in a blog post.

At the moment, the protocol is designed for use by the British government. But it is open source, so the concern is that it could be adopted by commercial entities.

Backdoor Claim

The MIKEY-SAKKE (Multimedia Internet KEYing-Sakai-KasaharaKey Encryption) protocol allows for a master decryption key to be held by a service provider, according to Murdoch.

“MIKEY-SAKKE is the security protocol behind the Secure Chorus voice (and also video) encryption standard, commissioned and designed by GCHQ through their information security arm, CESG,” he wrote.

According to Dr Murdoch, the advantage of MIKEY-SAKKE is that it doesn’t use digital certificates. Rather it uses identity-based encryption for key exchange. But this means private keys for users are generated by network providers with a master private key.

And herein lies the problem. These master private keys are valid indefinitely, and make the crypto algorithm vulnerable to silent interception and future decryption, the researcher warned.

“The existence of a master private key that can decrypt all calls past and present without detection, on a computer permanently available, creates a huge security risk, and an irresistible target for attackers,” he wrote.

“We do not recognise the claims made in this paper,” a spokesman for GCHQ told the BBC.

Expert Comment

“It’s interesting that GCHQ has developed its own VoIP encryption protocol, although like any form of technology, ‘key escrow’ is not inherently evil,” commented Justin Harvey, chief security officer at Fidelis Cybersecurity.

“The UK Government is currently advocating backdoors in encryption products that can supposedly only be used by law enforcement to enable them to read secure messages, such as text messages, emails and internet traffic,” said Harvey.

“The Government should come to the realisation that the inclusion of backdoors in encryption isn’t merely a legislative or privacy mandate, however, it is technically impossible to control the use of a backdoor in this way,” he said.

“I liken the pro-backdoor encryption movement to complaints about the weather; some people complain about rain, snow or sunshine and wish it were otherwise, but in the end, we can’t do anything about it,” he said. “The same is true for strong encryption.”

Encryption Battle

Encryption remains a very touchy subject at the moment. Leading technology companies and privacy campaigners have consistently opposed efforts to weaken encryption systems.

Last June a number of leading technology companies including Google, Apple, IBM, Microsoft and Facebook wrote a strongly-worded open letter to President Obama, calling for him to respect the privacy rights of consumers by not weakening encryption systems.

Prime Minister David Cameron has previously said that he wanted British intelligence agencies to be able to monitor the encrypted communications of terror suspects.

Can you protect your privacy online? Take our quiz!

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

Ericsson To Cut 1,200 Jobs in Sweden Amid ‘Challenging’ Market

Swedish telecoms giant Ericsson blamed “challenging mobile networks market” and “further volume contraction” for job…

3 hours ago

FTX’s Sam Bankman-Fried Sentenced To 25 Years In Prison For $8bn Fraud

Dramatic downfall. Sam Bankman-Fried sentenced to 25 years in prison for masterminding $8bn fraud that…

4 hours ago

Elon Musk Orders FSD Demo For Every Tesla US Sale

Fallout avoidance? Tesla buyers in the US must be shown how to use the FSD…

5 hours ago

Amazon Pumps Another $2.75 Billion Into Anthropic

Amazon completes its $4bn investment into AI firm Anthropic, after providing an additional $2.75bn in…

6 hours ago

The Sustainability of AI

While AI promises unparalleled efficiency, productivity, and innovation, questions regarding its environmental impact loom large.…

9 hours ago

Trump’s Truth Social Makes Successful Market Debut

Shares in Donald Trump’s social media company rose about 16 percent after first day of…

10 hours ago