4 ms·

I can agree with the assessment of encrypted DBs and SSE schemes, but I don't feel like that's the case for a huge portion of theoretical-ish crypto. Sure, I'm

I can agree with the assessment of encrypted DBs and SSE schemes, but I don't feel like that's the case for a huge portion of theoretical-ish crypto. Sure, I'm not disagreeing that people don't break things; I'm just feel like that's not a primary focus of most academic cryptographers; taking a look at the papers in the last few CRYPTOs and EUROCRYPTs only consolidates this feeling. One exception to that is perhaps multilinear maps, for which candidates are proposed and broken all the time, but once a assumption becomes battle-tested then I feel the focus shifts to building things out of these assumption

CiPHPerCoder 10y ago
> I don't feel like that's the case for a huge portion of theoretical-ish crypto. You could always verify this feeling: https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=1 https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=...
- Ar-Curunir 10y ago
  ePrint is not necessarily the best indicator for such things, since essentially anybody can post there, but even so, from some random sampling it seems like more than a majority of papers are constructive and not about attacks.
  - tptacek 10y ago
    Let's try this, instead: can you name some important fundamental theoretical work in cryptography that isn't defined by attacks? Obviously, that's a subjective judgement. Whatever you name though, we can just look and see how much of it is defined by attacker capabilities.
    - Ar-Curunir 10y ago
      Zero knowledge proofs? Multiparty computation? These are the staples of theoretical crypto.
      - tptacek 10y ago
        Ok, let's say that those are. What's an important paper in either, so we can look at it more closely?
        Ar-Curunir 10y ago
        The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. As I said earlier, tye majority of crypto research is in the following scenario: pinning down a battle-tested assumption, using that assumption in a provably secure manner to construct new systems. zero knowledge, MPC, ORAM, etc. all fall within this paradigm. Constructing new assumptions is obviously a task where attacks are necessary, but new assumptions come along every 5-7 years; the intervening period is dominated by this black box use of assumptions. EDIT: see this[1] listof most cited security and crypto papers; very few attack papers. [1] http://saweis.net/posts/most-cited-security-papers-2013-2014.html http://saweis.net/posts/most-cited-security-papers-2013-2014...
        CiPHPerCoder 10y ago
        > The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Dave designs a ZKP protocol for a specific application. Jane finds a side-channel in the protocol that leaks some data about the secret being verified and publishes it. Is it still a zero knowledge proof? > Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. How do you prove security against stronger classes of adversaries without finding breaks in existing protocols, or at least trying to do so?
        Ar-Curunir 10y ago
        The property of being zero knowledge is entirely separate from properties of the implementation; side channels were simply absent from the original model. Either way, for every zero knowledge protocol, side channels are relevant only on the prover's side; verification cannot allow anyone to learn any information about the witness underlying the proof (other wise the proof is not zero knowledge). Sure, attacks can motivate some of the theory that is created, but most theory work only very loosely uses these attacks as motivation. A number of strengthening of the attack model are simply questions of curiosity: if we strengthened the threat model in this way, what guarantees do we have. Very rarely is it motivated by an actual attack.
    - rifung 10y ago
      Fully Homomorphic Encryption? I guess I don't know if that qualifies as being fundamental since it's very modern but it seems to be quite a popular topic right now.
baby 10y ago
https://www.dropbox.com/s/8bays3lv9enk66b/2016-08-16%2019.36.27.jpg?dl=0 https://www.dropbox.com/s/8bays3lv9enk66b/2016-08-16%2019.36... The most trending kind of paper at last crypto was about cryptanalysis
nickpsecurity 10y ago
Im mostly with tptacek and ciphercoder on this but they're not quite right. I go through tons of papers on INFOSEC research in a year. Many I see most points of the year are introducing crypto schemes or breaking them. I'll add there's a few other categories that require little breaker ability: 1. Verification of previously described properties of algorithms or protocols. This is basically math where key constraints could be done checklist style. 2. Building tools to support cryptography research or development. Cryptol is a great example of this. 3. Speed improvements on crypto algorithms that preserve mathematical properties. Analyzing against common flaws usually covers problems you could have here. 4. Usable crypto. There's some breaking that goes in this but it's mostly presentation stuff. Can often use battle-tested tools that come with tips for proper usage. These come to mind as not directly related to inventing or breaking new schemes far as crypto itself. I wouldn't need someone with the security mindset to do these things do much as give them some training on what to do and not to do. I think you were referring to No 1 on my list.

CiPHPerCoder 10y ago

> I don't feel like that's the case for a huge portion of theoretical-ish crypto. You could always verify this feeling: https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=1 https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=...

Ar-Curunir 10y ago
ePrint is not necessarily the best indicator for such things, since essentially anybody can post there, but even so, from some random sampling it seems like more than a majority of papers are constructive and not about attacks.
- tptacek 10y ago
  Let's try this, instead: can you name some important fundamental theoretical work in cryptography that isn't defined by attacks? Obviously, that's a subjective judgement. Whatever you name though, we can just look and see how much of it is defined by attacker capabilities.
  - Ar-Curunir 10y ago
    Zero knowledge proofs? Multiparty computation? These are the staples of theoretical crypto.
    - tptacek 10y ago
      Ok, let's say that those are. What's an important paper in either, so we can look at it more closely?
      - Ar-Curunir 10y ago
        The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. As I said earlier, tye majority of crypto research is in the following scenario: pinning down a battle-tested assumption, using that assumption in a provably secure manner to construct new systems. zero knowledge, MPC, ORAM, etc. all fall within this paradigm. Constructing new assumptions is obviously a task where attacks are necessary, but new assumptions come along every 5-7 years; the intervening period is dominated by this black box use of assumptions. EDIT: see this[1] listof most cited security and crypto papers; very few attack papers. [1] http://saweis.net/posts/most-cited-security-papers-2013-2014.html http://saweis.net/posts/most-cited-security-papers-2013-2014...
        CiPHPerCoder 10y ago
        > The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Dave designs a ZKP protocol for a specific application. Jane finds a side-channel in the protocol that leaks some data about the secret being verified and publishes it. Is it still a zero knowledge proof? > Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. How do you prove security against stronger classes of adversaries without finding breaks in existing protocols, or at least trying to do so?
        Ar-Curunir 10y ago
        The property of being zero knowledge is entirely separate from properties of the implementation; side channels were simply absent from the original model. Either way, for every zero knowledge protocol, side channels are relevant only on the prover's side; verification cannot allow anyone to learn any information about the witness underlying the proof (other wise the proof is not zero knowledge). Sure, attacks can motivate some of the theory that is created, but most theory work only very loosely uses these attacks as motivation. A number of strengthening of the attack model are simply questions of curiosity: if we strengthened the threat model in this way, what guarantees do we have. Very rarely is it motivated by an actual attack.
  - rifung 10y ago
    Fully Homomorphic Encryption? I guess I don't know if that qualifies as being fundamental since it's very modern but it seems to be quite a popular topic right now.

baby 10y ago

https://www.dropbox.com/s/8bays3lv9enk66b/2016-08-16%2019.36.27.jpg?dl=0 https://www.dropbox.com/s/8bays3lv9enk66b/2016-08-16%2019.36... The most trending kind of paper at last crypto was about cryptanalysis

nickpsecurity 10y ago

Im mostly with tptacek and ciphercoder on this but they're not quite right. I go through tons of papers on INFOSEC research in a year. Many I see most points of the year are introducing crypto schemes or breaking them. I'll add there's a few other categories that require little breaker ability: 1. Verification of previously described properties of algorithms or protocols. This is basically math where key constraints could be done checklist style. 2. Building tools to support cryptography research or development. Cryptol is a great example of this. 3. Speed improvements on crypto algorithms that preserve mathematical properties. Analyzing against common flaws usually covers problems you could have here. 4. Usable crypto. There's some breaking that goes in this but it's mostly presentation stuff. Can often use battle-tested tools that come with tips for proper usage. These come to mind as not directly related to inventing or breaking new schemes far as crypto itself. I wouldn't need someone with the security mindset to do these things do much as give them some training on what to do and not to do. I think you were referring to No 1 on my list.