4 ms·

It seems like the author approached crypto (and security) from a perspective of breaking things. Sure, that's a fundamental part of both fields, but the harder

It seems like the author approached crypto (and security) from a perspective of breaking things. Sure, that's a fundamental part of both fields, but the harder (and IMO) more fun part is building secure systems. That's the entire reason you have proofs of security in crypto: to show that breaks are unlikely. I don't quite see why crypto should be "blindly result-oriented", and whether that's even a good thing; when public key crypto was invented it was wildly impractical. The vast majority of crypto is usually not about breaks.

tptacek 10y ago
The opposite is true. There's no discipline in computer science that is more about breaks than cryptography. The whole field is refined down to the tension between performance and vulnerabilities. What you can do in a cryptosystem is defined by breaks; progress in the field is punctuated by breaks. For what it's worth: Thomas Dullien is a cryptographer by training; he was one of Dobbertin's doctoral students.
- Ar-Curunir 10y ago
  Perhaps you refer to a specific part of applied crypto; most crypto, from what I've seen, is not focused on breaks of the cryptanalytic kind (as in "oh, let's try to break SHA256!"). Note that I'm speaking from an academic perspective.
  - tptacek 10y ago
    No, I'm referring to theoretical cryptography as well. One example: the CAESAR competition that is trying to select a portfolio of next-generation AEADs. Ciphers and constructions are entered, and submissions are sorted by the success of attacks. Another example: databases and format-preserving encryption. It might look like Order Revealing Encryption is an exercise in building things, but it's also a response to vulnerabilities in Order Preserving Encryption. One team develops something like cryptdb; another tears up cryptdb and uses its findings to design Cipherbase (or whatever). Unlike in generalist software development, most new things in crypto are responses to breaks, often by the authors of the breaks.
    - Ar-Curunir 10y ago
      I can agree with the assessment of encrypted DBs and SSE schemes, but I don't feel like that's the case for a huge portion of theoretical-ish crypto. Sure, I'm not disagreeing that people don't break things; I'm just feel like that's not a primary focus of most academic cryptographers; taking a look at the papers in the last few CRYPTOs and EUROCRYPTs only consolidates this feeling. One exception to that is perhaps multilinear maps, for which candidates are proposed and broken all the time, but once a assumption becomes battle-tested then I feel the focus shifts to building things out of these assumption
      - CiPHPerCoder 10y ago
        > I don't feel like that's the case for a huge portion of theoretical-ish crypto. You could always verify this feeling: https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=1 https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=...
        Ar-Curunir 10y ago
        ePrint is not necessarily the best indicator for such things, since essentially anybody can post there, but even so, from some random sampling it seems like more than a majority of papers are constructive and not about attacks.
        tptacek 10y ago
        Let's try this, instead: can you name some important fundamental theoretical work in cryptography that isn't defined by attacks? Obviously, that's a subjective judgement. Whatever you name though, we can just look and see how much of it is defined by attacker capabilities.
        Ar-Curunir 10y ago
        Zero knowledge proofs? Multiparty computation? These are the staples of theoretical crypto.

tptacek 10y ago

The opposite is true. There's no discipline in computer science that is more about breaks than cryptography. The whole field is refined down to the tension between performance and vulnerabilities. What you can do in a cryptosystem is defined by breaks; progress in the field is punctuated by breaks. For what it's worth: Thomas Dullien is a cryptographer by training; he was one of Dobbertin's doctoral students.

Ar-Curunir 10y ago
Perhaps you refer to a specific part of applied crypto; most crypto, from what I've seen, is not focused on breaks of the cryptanalytic kind (as in "oh, let's try to break SHA256!"). Note that I'm speaking from an academic perspective.
- tptacek 10y ago
  No, I'm referring to theoretical cryptography as well. One example: the CAESAR competition that is trying to select a portfolio of next-generation AEADs. Ciphers and constructions are entered, and submissions are sorted by the success of attacks. Another example: databases and format-preserving encryption. It might look like Order Revealing Encryption is an exercise in building things, but it's also a response to vulnerabilities in Order Preserving Encryption. One team develops something like cryptdb; another tears up cryptdb and uses its findings to design Cipherbase (or whatever). Unlike in generalist software development, most new things in crypto are responses to breaks, often by the authors of the breaks.
  - Ar-Curunir 10y ago
    I can agree with the assessment of encrypted DBs and SSE schemes, but I don't feel like that's the case for a huge portion of theoretical-ish crypto. Sure, I'm not disagreeing that people don't break things; I'm just feel like that's not a primary focus of most academic cryptographers; taking a look at the papers in the last few CRYPTOs and EUROCRYPTs only consolidates this feeling. One exception to that is perhaps multilinear maps, for which candidates are proposed and broken all the time, but once a assumption becomes battle-tested then I feel the focus shifts to building things out of these assumption
    - CiPHPerCoder 10y ago
      > I don't feel like that's the case for a huge portion of theoretical-ish crypto. You could always verify this feeling: https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=1 https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=...
      - Ar-Curunir 10y ago
        ePrint is not necessarily the best indicator for such things, since essentially anybody can post there, but even so, from some random sampling it seems like more than a majority of papers are constructive and not about attacks.
        tptacek 10y ago
        Let's try this, instead: can you name some important fundamental theoretical work in cryptography that isn't defined by attacks? Obviously, that's a subjective judgement. Whatever you name though, we can just look and see how much of it is defined by attacker capabilities.
        Ar-Curunir 10y ago
        Zero knowledge proofs? Multiparty computation? These are the staples of theoretical crypto.