Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm not a Cryptography expert, but i've seen this topic sometimes on the Web: Master decrypt keys.

Most of the people said that "Master decrypt key" does not exist.

This makes sense if you developed your own Cryptography software.

But if a company releases a cryptography software, where the user must enter the content (string or file), and a password, and then he gets the output, wouldnt the company be able to include the user password in another string encrypted with the company's password in somepart of the file? so no matter the user has encrypted the file with 30 keys, the company could decrypt it's part of the file and get the user key to decrypt the entire file

does it make any sense? I was wondering this for security reasons

share|improve this question
1  
Many respectable security applications, including GPG, can be configured to encrypt in a manner such that a "Master decrypt key" can decrypt. This is useful in a corporate context, so that what employees send can be deciphered in case of need. In GPG 1.4, this can be accomplished with encrypt-to keyID in gpg.conf. This is not covert, and warnings will appear if the "Master decrypt key" is not entrusted. – fgrieu Feb 19 at 11:42

1 Answer

up vote 1 down vote accepted

In theory, someone could do this, but in practice nobody really uses random, sketchy third party cryptography software. Most, if not all, of the commonly used cryptography functions are well understood and tested. Most of them also openly reveal precisely how they work so anyone can implement them. This means lots of people can analyse the algorithms for built in weaknesses like the one you described.

The case you described is a good reason to stay away from unknown and untrusted third party cryptography software.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.