7
$\begingroup$

Looking for the language to describe a solution I am looking for...

As a systems admin for an educational institution, I would like to: a) post our tests in an encrypted form b) at a certain time, make the contents available to the user (online or not) c) after a certain time, re-encrypt the file, and/or delete the content.

During the unencrypted time, I would like to prevent copy operations, cut/paste etc. to protect the content...

Is this "mission impossible" type encryption style even possible to protect our content?

If so, what would it be called?

Many thanks for your assistance

$\endgroup$
5
  • 2
    $\begingroup$ c) is digital rights management territory and doesn't necessarily have something to do with cryptography. There are proprietary software solutions for this sort of thing and it would be quite hard to write such a solution yourself. There is also the issue of screenshots or photos of the screen that you will not be able to prevent. $\endgroup$
    – Artjom B.
    May 22, 2018 at 13:07
  • 6
    $\begingroup$ From a "purely mathematical" point of view - id est, from the perspective of cryptography - preventing copy/pasting any piece of data which is made available to a user is definitely impossible. You would have to ressort to some software-based solution to prevent naive copy/pasting, but you'll never make it impossible for a user to e.g. take a picture of his screen with his smartphone. $\endgroup$ May 22, 2018 at 13:08
  • 1
    $\begingroup$ @GeoffroyCouteau is absolutely right, but to confuse the layman Google is testing self destructing mails. "techcrunch.com/2018/04/13/…" . I'm guessing that means just possing an image of text on a web link and then later removing that image. That is certainly not time encryption, but it could have some practical advantages: (1) It keeps names, addresses, phone numbers and other information away from most web crawlers and scammers, (cont...) $\endgroup$ May 22, 2018 at 22:07
  • 2
    $\begingroup$ (...cont) (2) if someone uses the information in the mail in a way that impinges on the authors ownership of it, it's easier to show that use was intentional and not accidental. $\endgroup$ May 22, 2018 at 22:08
  • $\begingroup$ The idea of a file that decrypts after a certain amount of time is often called time-lock encryption. There's a page about different techniques here: gwern.net/Self-decrypting-files $\endgroup$
    – Macil
    May 26, 2018 at 0:06

1 Answer 1

6
$\begingroup$

"Impossible" might be appropriate. And "Not really a cryptography issue." Summing up Artjom's and Geoffroy's comments, nothing can stop you pointing a camera at the screen. Or perhaps taking a screen grab. There is the notion of an Analogue Hole, which means that ultimately if you can see it, you can record it.

But that's not really necessary. Virtually all mainstream content transmission protocols have been cracked directly via interception software or accessing a master key. You can easily record directly from the BBC, PornHub and YouTube as simple examples. These services have huge incentive to prevent unauthorised copying and can't, so it's unlikely a school can succeed where major global players can't. This all becomes much easier on Linux powered devices where you have total control over the kernel. Linux also comes by default with the ability to record anything playing on the sound card, so audio protection is non existent on that platform. And text can be spoken by a screen reader, which can then be recorded via the sound card feature above. Then speech recognition $ \rightarrow $ text and so on and on.

Clearly you can release encrypted content, then either repost the plain text or the key to allow users to decrypt. But then you've lost all control of the data. It's out. Re-encrypting will just create a copy of the files you already had before decryption. The decrypted content may have been copied off machine. USB stick perhaps. The whole of the political European Union wants content to be able to be deleted for ever, but they haven't achieved it yet. Perhaps General Data Protection Regulation might work, but I doubt it. And a server restore can bring it all back, and this has happened as you hear it in the news occasionally.

Another comment provides us with a fine example of irony - Google's attempt at self destructing emails. I'm assuming that this is exactly the kind of copy protection that you're looking for. The irony is found in the mere existence of the following screen grab of such a test email featuring a clear expiry date. Assume it expired yesterday:-

gmail

So what? Not only has it been screen grabbed and made immutable, I've just reposted it here. So the irony is further exacerbated in that whilst the email might disappear off the Gmail system in a puff of smoke, Googlebot has already indexed this answer and made it available on the Google search engine! And as the email text is a nice clear modern machine font, OCR techniques allow for it to be extracted automatically from image format to text. This is a perfect measure of the size of the Analogue Hole and how even a billion dollar company cannot fill it in.

There's my answer here to "Can a device prove the identity of its own code?" which really asks if a voting machine can be hacked, even with specialist hardware protection. You're asking almost the same question, regarding a computer displaying some content. Yes it can be.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.