4 ms·

Why do people insist on using the term zero knowledge for simple semantically secure encryption? Zero knowledge has a very specific meaning inside cryptography

Why do people insist on using the term zero knowledge for simple semantically secure encryption? Zero knowledge has a very specific meaning inside cryptography. Encrypting something does not make it "zero knowledge".

schoen 10y ago
I think this is a terminological suggestion from SpiderOak https://spideroak.com/features/zero-knowledge https://spideroak.com/features/zero-knowledge It's true that it doesn't match the technical meaning of zero knowledge from cryptography (although maybe arguably the meaning of the technical term could be extended to this situation in a trivial way: rather than a proof or protocol involving Bob from which Bob doesn't learn certain information, this is a protocol not involving Bob from which Bob also doesn't learn certain information).
- CiPHPerCoder 10y ago
  Counter argument: https://paragonie.com/blog/2016/08/crypto-misnomers-zero-knowledge-considered-self-descriptive https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno... Summary: zero-knowledge applies to authentication protocols, not encryption protocols.
  - schoen 10y ago
    I think I'm inclined to agree with that interpretation. I wish we had a clearer term for systems where you don't trust an intermediary with some kind of access. (We often say "end-to-end encrypted", but that's kind of weird for file storage or other data-at-rest situations.)
    - CiPHPerCoder 10y ago
      > I wish we had a clearer term for systems where you don't trust an intermediary with some kind of access. We already have one or more of: - Confidential - End-to-end encrypted (contrasted with, but often in addition to, transport-layer encryption) - Privacy-preserving - Least authority (with respect to the service operator) - Peer-to-peer privacy I'm one degree of separation from several SpiderOak engineers and think highly of them overall. However, this choice of marketing copy is one point we vehemently disagree on.
no_protocol 10y ago
I had the same feeling when reading the copy on the site. I looked for an explanation of what they mean by the statement, but couldn't find one. Google led me to a Spider Oak page that seems to use the terminology in a similar manner [1]. I have a hard time even accepting this definition of "zero knowledge' on its own, separate from the existing cryptographic one. Wouldn't the host at least know things like the size of the encrypted data? Time it was sent? Etc. [1] https://spideroak.com/features/zero-knowledge https://spideroak.com/features/zero-knowledge
- whamlastxmas 10y ago
  File size and date sent is probably only useful if someone is specifically targeting you, and it's virtually guaranteed that the only person who wound target someone specifically and also be able to make use of that data is a government agency. In that case they'd be able to monitor your data at an ISP level anyway, making it moot. It doesn't look like Spideroak takes bitcoin payments anyway, making this even further moot. Anyone serious about privacy against state actors wouldn't use it.
  - coldwaterq 10y ago
    I don't agree that only government agencies would care. For example, anyone on open wifi can be easily targeted. So anyone doing something at a university could be targeted. I would imagine that some corporation would be interested in something from a university enough to try this.
  - no_protocol 10y ago
    Useful or not, I consider the boldface statement > we know nothing about the encrypted data you store on our servers misleading, since they do know some things about the encrypted data.
    - whamlastxmas 10y ago
      I strongly support SpiderOak but I agree with you. Even if they don't keep logs of that stuff, they could or could be ordered to do so. They obviously think the "ordered to do so" part is a real threat because they dissuade used from logging in through the website.
infodroid 10y ago
> Why do people insist on using the term zero knowledge for simple semantically secure encryption? Note that in the domain of privacy-enhancing technologies the term "zero-knowledge" does not refer to "semantically secure encryption". Instead it is used to mean that a service provider does not have access to user data, and that this claim can be proven cryptographically. The use of the term zero-knowledge to promote privacy-respecting services dates back to at least 1997 with the founding of the Canadian company Zero-Knowledge Systems [1], which provided anonymous communication services [2]. [1] https://en.wikipedia.org/wiki/Zero_Knowledge_Systems https://en.wikipedia.org/wiki/Zero_Knowledge_Systems [2] http://edition.cnn.com/TECH/computing/9902/11/browsanon.idg/ http://edition.cnn.com/TECH/computing/9902/11/browsanon.idg/
- Ar-Curunir 10y ago
  Note that in the field of cryptography, the term zero knowledge refers to zero knowledge proofs, which predate that company by over 13 years.
  - infodroid 10y ago
    I don't dispute that fact. But there is precedent for the use of the term in privacy-respecting services, so we shouldn't be surprised when we encounter it. After ZKS shut down, the term continued to be used by hosting and communications services to explain their value proposition in a simple way. Having said that, I agree with the point that nowadays this usage may be unhelpful in promoting privacy-respecting services because zero-knowledge proofs have come a long way and there are now services like Zerocash that actually make use of them. So using the term to promote a different privacy-respecting feature may be confusing or misleading.
    - SilasX 10y ago
      I wish they would pick a clearer term that's not already in use, like (as I think they mean in this case) "provider-obscured". Heck, even "homomorphic" would be better, as that signifies "does stuff you want with your data, without knowing the content of said data".
rarrrrrr 10y ago
This is a fair question. I'm somewhat to blame for contributing to it over the last 10 years via SpiderOak. There are very good reasons though, and it's probably time I made a post about it.
- CiPHPerCoder 10y ago
  > There are very good reasons though, Okay, I'd really like to hear the argument about why muddying the waters about an already-hard-to-understand subject is totally fine. > and it's probably time I made a post about it. Please do. A blog post that I linked elsewhere in this thread makes the case for why it's harmful.

schoen 10y ago

I think this is a terminological suggestion from SpiderOak https://spideroak.com/features/zero-knowledge https://spideroak.com/features/zero-knowledge It's true that it doesn't match the technical meaning of zero knowledge from cryptography (although maybe arguably the meaning of the technical term could be extended to this situation in a trivial way: rather than a proof or protocol involving Bob from which Bob doesn't learn certain information, this is a protocol not involving Bob from which Bob also doesn't learn certain information).

CiPHPerCoder 10y ago
Counter argument: https://paragonie.com/blog/2016/08/crypto-misnomers-zero-knowledge-considered-self-descriptive https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno... Summary: zero-knowledge applies to authentication protocols, not encryption protocols.
- schoen 10y ago
  I think I'm inclined to agree with that interpretation. I wish we had a clearer term for systems where you don't trust an intermediary with some kind of access. (We often say "end-to-end encrypted", but that's kind of weird for file storage or other data-at-rest situations.)
  - CiPHPerCoder 10y ago
    > I wish we had a clearer term for systems where you don't trust an intermediary with some kind of access. We already have one or more of: - Confidential - End-to-end encrypted (contrasted with, but often in addition to, transport-layer encryption) - Privacy-preserving - Least authority (with respect to the service operator) - Peer-to-peer privacy I'm one degree of separation from several SpiderOak engineers and think highly of them overall. However, this choice of marketing copy is one point we vehemently disagree on.

no_protocol 10y ago

I had the same feeling when reading the copy on the site. I looked for an explanation of what they mean by the statement, but couldn't find one. Google led me to a Spider Oak page that seems to use the terminology in a similar manner [1]. I have a hard time even accepting this definition of "zero knowledge' on its own, separate from the existing cryptographic one. Wouldn't the host at least know things like the size of the encrypted data? Time it was sent? Etc. [1] https://spideroak.com/features/zero-knowledge https://spideroak.com/features/zero-knowledge

whamlastxmas 10y ago
File size and date sent is probably only useful if someone is specifically targeting you, and it's virtually guaranteed that the only person who wound target someone specifically and also be able to make use of that data is a government agency. In that case they'd be able to monitor your data at an ISP level anyway, making it moot. It doesn't look like Spideroak takes bitcoin payments anyway, making this even further moot. Anyone serious about privacy against state actors wouldn't use it.
- coldwaterq 10y ago
  I don't agree that only government agencies would care. For example, anyone on open wifi can be easily targeted. So anyone doing something at a university could be targeted. I would imagine that some corporation would be interested in something from a university enough to try this.
- no_protocol 10y ago
  Useful or not, I consider the boldface statement > we know nothing about the encrypted data you store on our servers misleading, since they do know some things about the encrypted data.
  - whamlastxmas 10y ago
    I strongly support SpiderOak but I agree with you. Even if they don't keep logs of that stuff, they could or could be ordered to do so. They obviously think the "ordered to do so" part is a real threat because they dissuade used from logging in through the website.

infodroid 10y ago

> Why do people insist on using the term zero knowledge for simple semantically secure encryption? Note that in the domain of privacy-enhancing technologies the term "zero-knowledge" does not refer to "semantically secure encryption". Instead it is used to mean that a service provider does not have access to user data, and that this claim can be proven cryptographically. The use of the term zero-knowledge to promote privacy-respecting services dates back to at least 1997 with the founding of the Canadian company Zero-Knowledge Systems [1], which provided anonymous communication services [2]. [1] https://en.wikipedia.org/wiki/Zero_Knowledge_Systems https://en.wikipedia.org/wiki/Zero_Knowledge_Systems [2] http://edition.cnn.com/TECH/computing/9902/11/browsanon.idg/ http://edition.cnn.com/TECH/computing/9902/11/browsanon.idg/

Ar-Curunir 10y ago
Note that in the field of cryptography, the term zero knowledge refers to zero knowledge proofs, which predate that company by over 13 years.
- infodroid 10y ago
  I don't dispute that fact. But there is precedent for the use of the term in privacy-respecting services, so we shouldn't be surprised when we encounter it. After ZKS shut down, the term continued to be used by hosting and communications services to explain their value proposition in a simple way. Having said that, I agree with the point that nowadays this usage may be unhelpful in promoting privacy-respecting services because zero-knowledge proofs have come a long way and there are now services like Zerocash that actually make use of them. So using the term to promote a different privacy-respecting feature may be confusing or misleading.
  - SilasX 10y ago
    I wish they would pick a clearer term that's not already in use, like (as I think they mean in this case) "provider-obscured". Heck, even "homomorphic" would be better, as that signifies "does stuff you want with your data, without knowing the content of said data".

rarrrrrr 10y ago

This is a fair question. I'm somewhat to blame for contributing to it over the last 10 years via SpiderOak. There are very good reasons though, and it's probably time I made a post about it.

CiPHPerCoder 10y ago
> There are very good reasons though, Okay, I'd really like to hear the argument about why muddying the waters about an already-hard-to-understand subject is totally fine. > and it's probably time I made a post about it. Please do. A blog post that I linked elsewhere in this thread makes the case for why it's harmful.