There have been reports stating that RIM has given into the demands of the Saudi government and placed a local RIM server which would allow the security agencies to snoop on the conversations happening over BBM/PIN2PIN. This was easy to achieve considering that there is only a single encryption key involved and that the key was easily available.
It would be interesting to know how the demands of other governments would be met by RIM. Indian government has been demanding that it needs access to the emails being sent using the Blackberry Enterprise Servers. UAE government has concerns in the emails being sent out of the country.
The BES architecture uses multiple keys which are dynamically generated and managed between the device and the BES Server. Let us see what happens when Alice sends an email to Bob who is a blackberry user in the same organization.
1. Alice sends an email message to bob’s email address using her desktop email client.2. The email server receives the email and sends it to bob’s mailbox.
3. The BES server receives the email from the Mail Server to be delivered to Bob’s BB Device.
4. The BES server compresses and encrypts the message using multiple message keys.
5. The message key is encrypted using the device transport key.
6. The encrypted message and the encrypted device transport key are sent to the device thru the RIM relay Servers.
7. The message gets delivered over the air (OTA) to the blackberry device thru the wireless connectivity provided by the ISP.
8. The device decrypts the message keys with the transport key.
9. The device applies the message keys to the encrypted message and displays it to Bob.
So it’s the device transport keys which the governments are expecting RIM to provide them so that they could intercept and decrypt the emails passing thru their ISP networks.
So how is this Device Transport Key generated and maintained? The following details are from security documentation published by RIM.
“The BlackBerry® Enterprise Server and BlackBerry device negotiate to select the strongest algorithm that they both support (either AES or Triple DES) and use that algorithm to generate a device transport key during an over the air activation of the device.”
“By default, the BlackBerry® Enterprise Server and BlackBerry device generate subsequent device transport keys every 30 days. The BlackBerry Enterprise Server and BlackBerry device generate the device transport key using existing long-term public keys and the ECMQV key exchange algorithm to negotiate a device transport key. This method is designed so that a potentially malicious user is unable to calculate the device transport key. The BlackBerry Enterprise Server and BlackBerry device discard the key pair after they generate the device transport key.”
RIM seems to have made sure with this architecture that there is no way a third party (including itself) will ever get access to the device transport keys.
So there is a device transport key unique to every device and it changes every 30 days. In a country with a million blackberry users even if half of them were BES enabled, the ISP would require quite a large infrastructure to hold and manage these keys and probably a super computer to apply the corresponding device transport keys to decrypt the message keys and then apply the message keys to the encrypted message and then decrypt and store them. All this to intercept communication between terrorists!! As mentioned in my previous post, after all the media attention and the government demands for interception the Osama’s and Obama’s would never use a blackberry to do any serious communication.
The question remains on how RIM would get hold of these keys. It has to either alter the device configuration to send the device transport keys to a local server, or it has to modify the BES Server architecture to upload the device transport keys to the local server in the country. Both of which are difficult to achieve as it involves a software upgrade either on millions of devices or on thousands of servers.
What every government is demanding is a copy of the device transport key of every device connected to a BES Server in the country. Let’s say that I work in India and my company’s blackberry server is in Timbuktu. The Indian government would not have the keys to see my communication!! Wouldn’t this be the typical case of a terrorist? Assuming that the typical terrorist is a foreigner he would be using a blackberry device supported by an ISP of another country to which my local government doesn’t have keys. I wonder how many terrorists have a registered office and a datacenter to host a blackberry enterprise server!
If the RIM documentations about the architecture are to be believed there is no foolproof technical solution to address the concerns of these government entities. It’s hard to believe that the RIM technical team hasn’t been able to communicate the same to the government agencies and close the issue. So how will the stalemate end? Will blackberry be banned in these countries or will it be a face saving exercise of placing a local server in every country which would just display lines of encrypted text on the screens? If that is the case RIM will add another product line to its portfolio:-Face Saving Relay Servers in different colors. The countries will get to choose from a Red, Orange or a BLACK BOX.
No comments:
Post a Comment