6 ms·

I can't wait to find exploitable side-channels in the first-to-market implementations of this idea. Lattice-based crypto is all the rage among snakeoil marketi

I can't wait to find exploitable side-channels in the first-to-market implementations of this idea. Lattice-based crypto is all the rage among snakeoil marketing (right after One-Time-Pads).

jmnicolas 10y ago
What's wrong with one time pads ?
- dangerlibrary 10y ago
  Nothing's wrong with one time pads. They're as good as they've ever been, which is to say: completely impractical for use on the internet and almost all other computing applications. Also, no forward secrecy.
  - chopin 10y ago
    >Also, no forward secrecy. My understanding of OTP's implies that these must be used only once. As such they offer the same PFS as all the schemes I know of. PFS does not guarantee the secrecy of a specific message. It does guarantee that if you are able to crack one message you can't use the key to crack others. Therefore if you use an OTP only once it gives you the same guarantees.
- andreareina 10y ago
  Key exchange, plus the fact that the key is the same size of the message, and can only be used once. This means that securely exchanging keys is as hard as securely exchanging the message itself -- if you had a way to exchange the keys, you might as well exchange the message itself and be done with it.
- CiPHPerCoder 10y ago
  https://freedom-to-tinker.com/blog/jbonneau/be-wary-of-one-time-pads-and-other-crypto-unicorns/ https://freedom-to-tinker.com/blog/jbonneau/be-wary-of-one-t...
Ar-Curunir 10y ago
Lol lattice-based theoretical crypto has solid theoretical foundations. Finding the correct paramter ranges for applications is difficult and that's why you aren't seeing widespread usage yet, but it's certainly not snake-oil. And don't get your hopes up about seeing a practical implementation of iO any time soon; it's thoroughly and utterly impractical at the moment, and will remain so for the foreseeable future.
- CiPHPerCoder 10y ago
  > Lol lattice-based theoretical crypto has solid theoretical foundations. Yes, it was (is?) one of the candidates for post-quantum public-key encryption. But that doesn't stop terrible projects from claiming to have it in their marketing today.
mike_hearn 10y ago
Lattice-based crypto seems to be on the way out already: most papers I see exploring cutting edge crypto are based on ring-LWE, which is a different problem that was proven (by Regev) to reduce to the SVP problem over integer lattices, thus being equally as hard. But it's not actually a lattice problem itself.
- mti 10y ago
  LWE and SIS-based cryptography absolutely is lattice-based crypto, and I can't really imagine what other kind of scheme you would deem more deserving of the name than those. Even the epitome of classical lattice-based crypto, Ajtai-Dwork, is proved secure under a problem (hidden hyperplane) which is "not actually a lattice problem itself", at least not anymore than LWE and SIS. But being based on a problem equivalent to worst-case lattice problems under polynomial-time reductions strikes me as the strongest possible sense in which you could claim a scheme to be lattice-based.
  - mike_hearn 10y ago
    I meant ring LWE is not the same problem as SVP. Perhaps I have misunderstood the algorithm but I do not see any lattices in the description of ring LWE. The fact that it's equivalent in hardness doesn't, to my mind, imply it's "lattice based".

I can't wait to find exploitable side-channels in the first-to-market implementations of this idea. Lattice-based crypto is all the rage among snakeoil marketing (right after One-Time-Pads).

jmnicolas 10y ago

What's wrong with one time pads ?

dangerlibrary 10y ago
Nothing's wrong with one time pads. They're as good as they've ever been, which is to say: completely impractical for use on the internet and almost all other computing applications. Also, no forward secrecy.
- chopin 10y ago
  >Also, no forward secrecy. My understanding of OTP's implies that these must be used only once. As such they offer the same PFS as all the schemes I know of. PFS does not guarantee the secrecy of a specific message. It does guarantee that if you are able to crack one message you can't use the key to crack others. Therefore if you use an OTP only once it gives you the same guarantees.
andreareina 10y ago
Key exchange, plus the fact that the key is the same size of the message, and can only be used once. This means that securely exchanging keys is as hard as securely exchanging the message itself -- if you had a way to exchange the keys, you might as well exchange the message itself and be done with it.
CiPHPerCoder 10y ago
https://freedom-to-tinker.com/blog/jbonneau/be-wary-of-one-time-pads-and-other-crypto-unicorns/ https://freedom-to-tinker.com/blog/jbonneau/be-wary-of-one-t...

Ar-Curunir 10y ago

Lol lattice-based theoretical crypto has solid theoretical foundations. Finding the correct paramter ranges for applications is difficult and that's why you aren't seeing widespread usage yet, but it's certainly not snake-oil. And don't get your hopes up about seeing a practical implementation of iO any time soon; it's thoroughly and utterly impractical at the moment, and will remain so for the foreseeable future.

CiPHPerCoder 10y ago
> Lol lattice-based theoretical crypto has solid theoretical foundations. Yes, it was (is?) one of the candidates for post-quantum public-key encryption. But that doesn't stop terrible projects from claiming to have it in their marketing today.

mike_hearn 10y ago

Lattice-based crypto seems to be on the way out already: most papers I see exploring cutting edge crypto are based on ring-LWE, which is a different problem that was proven (by Regev) to reduce to the SVP problem over integer lattices, thus being equally as hard. But it's not actually a lattice problem itself.

mti 10y ago
LWE and SIS-based cryptography absolutely is lattice-based crypto, and I can't really imagine what other kind of scheme you would deem more deserving of the name than those. Even the epitome of classical lattice-based crypto, Ajtai-Dwork, is proved secure under a problem (hidden hyperplane) which is "not actually a lattice problem itself", at least not anymore than LWE and SIS. But being based on a problem equivalent to worst-case lattice problems under polynomial-time reductions strikes me as the strongest possible sense in which you could claim a scheme to be lattice-based.
- mike_hearn 10y ago
  I meant ring LWE is not the same problem as SVP. Perhaps I have misunderstood the algorithm but I do not see any lattices in the description of ring LWE. The fact that it's equivalent in hardness doesn't, to my mind, imply it's "lattice based".