software open-source-software is-x-legal encryption cryptography
Is it legal to make encryption breaking technology public?
<p>Much of our critical infrastructure relies on encryption as the bedrock of its security. Encryption, however, is a practically a &quot;very hard&quot; mathematical problem that will take eternity to solve with current technology.</p>
<p>Let us say someone using the Ballmer's peak to their advantage (lol) develops an algorithm that allows us to solve that incredibly hard math problem in minutes. Is it legal for them to open-source this algorithm and also publicize about how it can help break encryption (they never talk about stealing)?</p>
<p>I get that someone using the algorithm to break into someone else's system is a crime, same as robbing something from a house for which you can now make the keys. But open-sourcing such a critical solution will empower bad actors and nation states to hack other's systems regardless.</p>
<p>Is our boy-genius developer legally (not ethically) obligated to do anything if they make such a discovery?</p>

<p>There are two processes that go on all the time, and are generally considered legal:</p>
<ol>
<li><p>Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The <a href="https://en.wikipedia.org/wiki/SHA-1#Attacks" rel="nofollow noreferrer">history of SHA-1</a> is a good example of this.</p>
</li>
<li><p>People identify security holes in software and follow <a href="https://en.wikipedia.org/wiki/Responsible_disclosure" rel="nofollow noreferrer">responsible disclosure</a> rules. This means that they notify the vendor and give them an opportunity to fix the bug before going public. Note that this is merely considered good practice; immediate publication would be legal too.</p>
</li>
</ol>
<p>Your scenario sits at the intersection of these two processes: an attack (process 1) which completely destroys the security of many systems (process 2).</p>
<p>Responsible disclosure occupies a legal grey area: someone who finds a bug might have had to exploit it to at least some degree to demonstrate it, and there have been cases where vendors have used police or courts to retaliate. However this wouldn't apply to your scenario.</p>
<p>In America the First Amendment makes it unconstitutional to use the legal system to stop people saying true things (copyright excepted, and untrue things are often legal too). If your Wunderkind lives in America then a widely published factual description of their solution would therefore be legal. Legal problems only start if they provide the details in secret to people they should reasonably suspect of intending to use them for crime.</p>
