2
$\begingroup$

I am studying Information Security, and I am wondering if I can send a message to my friend X and keep the message confidential without using encryption?

$\endgroup$
  • 2
    $\begingroup$ Sure, just use a confidential communication channel? $\endgroup$ – SEJPM Apr 26 '18 at 7:06
2
$\begingroup$

I think this is a question that comes down to understanding the basic Alice, Bob and Eve diagram from cryptography textbooks, like this one from Wikimedia that I've chosen because of its license and no other reason:

Alice, Bob and Eve

Alice and Bob are communicating over a channel, depicted as the green line, and Eve is eavesdropping on that channel, metaphorically depicted as if there was a blue cable that plugs into the channel and carries its signal to Eve. The reason Alice and Bob use encryption is because they're worried that the diagrammed situation might occur, and the goal of encryption is to make it so that, in that situation, Eve cannot learn much about their communication.

So it's hard to answer your question how to protect your messages without encryption other than by saying this: prevent any situation like the one described by that diagram from ever arising. But that's not a concrete or actionable recommendation—it depends on the physical details of whatever scenario you're considering. But to give one concrete example, the United States government uses something called a Sensitive Compartmented Information Facility (SCIF) to physically protect officials using sensitive information from being eavesdropped on. Example passage from the article:

Because SCIFs are supposed to distance sensitive information from the rest of the world, the Directive begins with architectural details—like adding a vestibule and extra interstitial reception spaces as "padding" between the SCIF and the outside. If the SCIF is a building (rather than a tent), it has to be reinforced concrete or lined with solid steel. Everything from the depth of the drywall to the thickness of the insulation is mandated by the document, too.

The first—and most traditional—surveillance threat is sound, so SCIFs are lined with thick acoustic piling. In most cases, noise-masking devices like transducers are installed to garble what's going on inside, too. According to the BBC, another type of wave-emitting device creates a ring of electronic signals around the space, blocking other types of electronic surveillance, while a lining of special, foil-like material also blocks more traditional audio surveillance (similar to an average Faraday Cage).

That's an extreme example, of course, but (a) without details it's basically impossible to make concrete recommendations and (b) specific recommendations would likely be off-topic here.

$\endgroup$
  • $\begingroup$ Not sure why this was downvoted: A secure communications channel is technically a viable alternative to using encryption and is basically a more in depth explanation of this up-voted answer. Whether or not it's a practical possibility (for non-state actors) is a different question, and the answer does disclaim that it's an extreme solution. The question asks about possibility, not convenience. $\endgroup$ – Ella Rose Apr 27 '18 at 3:46
1
$\begingroup$

Only if your communication channel is undoubtedly secure, so that nobody could dublicate the message, fetch the message during transmission, or read the message with any other methods which could be used.

$\endgroup$
1
$\begingroup$

You could use steganography or covert channel for digital messages.

In the end any secure communication channel could suffice. Even just a POTS phone call can be secure enough because it could be impossible to filter all the phone calls by an adversary (which may not be a governmental organization).

To see if it is secure enough you need to create a use case (or just goal), find out who your adversaries are and then create a threat model and analyze your system, just like you would do for a system that does apply cryptography.

The big problem is that you probably cannot put in a number on how secure the system is. That said, this is probably true for any real-life systems, including those that do apply cryptography.

$\endgroup$
  • $\begingroup$ I've put POTS here because GSM's for instance do use crypto (at least for the point to point connections), even if the schemes and providers can usually not be trusted enough to provide protection against larger organizations. $\endgroup$ – Maarten Bodewes Apr 26 '18 at 10:20
  • $\begingroup$ My reaction to the suggestion that one could try steganography instead of encryption is that they're orthogonal: you could use steganography to convey an encrypted message, so at first glance an argument in favor of steganography doesn't count against using encryption. And I suspect the fact that ciphertexts are supposed to be indistinguishable from random strings could actually help steganographic concealment; I understand some spread-spectrum radio systems achieve low probability of detection by using pseudorandom frequency hopping. $\endgroup$ – Luis Casillas Apr 26 '18 at 23:40
  • $\begingroup$ I didn't say that you couldn't use steganography with encryption or that it would not be beneficial to combine the two (it certainly is beneficial to do so). It is just that steganography could be used without encryption, and establishing a secure communication channel without encryption was the question. $\endgroup$ – Maarten Bodewes Apr 26 '18 at 23:46
  • $\begingroup$ @MaartenBodewes: You didn't say that, no, but I just think that you'll be implicitly understood as such in this context, given that the question is asking for alternatives to encryption. $\endgroup$ – Luis Casillas Apr 27 '18 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.