RIPA s 12(7)

[Ian Batten]

On 13 Jun 2014, at 10:47, Brian Morrison <bdm at fenrir.org.uk> wrote:

> On Thu, 12 Jun 2014 15:44:43 +0100
> Ian Batten wrote:
> 
>> "well, you could run that service, but you'd have to convince a judge
>> that your fancy zero-knowledge proof was genuine when you claim you
>> can't decrypt stuff on your network, encrypted with your software,
>> using keys that you store"
> 
> But isn't that the wrong thing to do? Surely the keys stored will only
> be the public keys, not the secret keys?

Yes, but it may not be quite as simple to show that you don’t have the private key if you’re
offering something more exotic than simply a directory of public keys.   For example, 
some of the certificate vendors have a “for the less sophisticated” path where instead of
submitting a CSR, you instead ask for a signed certificate and are given a certificate and
a private key.   They presumably then discard the private key.  Proving they did that might
be quite entertaining.  

ian