7 ms·

> I don't feel like that's the case for a huge portion of theoretical-ish crypto. You could always verify this feeling: https://eprint.iacr.org/eprint-bin/sea

> I don't feel like that's the case for a huge portion of theoretical-ish crypto. You could always verify this feeling: https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=1 https://eprint.iacr.org/eprint-bin/search.pl?last=365&title=...

Ar-Curunir 10y ago
ePrint is not necessarily the best indicator for such things, since essentially anybody can post there, but even so, from some random sampling it seems like more than a majority of papers are constructive and not about attacks.
- tptacek 10y ago
  Let's try this, instead: can you name some important fundamental theoretical work in cryptography that isn't defined by attacks? Obviously, that's a subjective judgement. Whatever you name though, we can just look and see how much of it is defined by attacker capabilities.
  - Ar-Curunir 10y ago
    Zero knowledge proofs? Multiparty computation? These are the staples of theoretical crypto.
    - tptacek 10y ago
      Ok, let's say that those are. What's an important paper in either, so we can look at it more closely?
      - Ar-Curunir 10y ago
        The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. As I said earlier, tye majority of crypto research is in the following scenario: pinning down a battle-tested assumption, using that assumption in a provably secure manner to construct new systems. zero knowledge, MPC, ORAM, etc. all fall within this paradigm. Constructing new assumptions is obviously a task where attacks are necessary, but new assumptions come along every 5-7 years; the intervening period is dominated by this black box use of assumptions. EDIT: see this[1] listof most cited security and crypto papers; very few attack papers. [1] http://saweis.net/posts/most-cited-security-papers-2013-2014.html http://saweis.net/posts/most-cited-security-papers-2013-2014...
        CiPHPerCoder 10y ago
        > The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Dave designs a ZKP protocol for a specific application. Jane finds a side-channel in the protocol that leaks some data about the secret being verified and publishes it. Is it still a zero knowledge proof? > Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. How do you prove security against stronger classes of adversaries without finding breaks in existing protocols, or at least trying to do so?
        Ar-Curunir 10y ago
        The property of being zero knowledge is entirely separate from properties of the implementation; side channels were simply absent from the original model. Either way, for every zero knowledge protocol, side channels are relevant only on the prover's side; verification cannot allow anyone to learn any information about the witness underlying the proof (other wise the proof is not zero knowledge). Sure, attacks can motivate some of the theory that is created, but most theory work only very loosely uses these attacks as motivation. A number of strengthening of the attack model are simply questions of curiosity: if we strengthened the threat model in this way, what guarantees do we have. Very rarely is it motivated by an actual attack.
        tptacek 10y ago
        At this point, I'm just going to say I take your point by stand by my own. Cryptography is unique among the disciplines we deal with in information security in being motivated entirely by attacks. In software engineering, we're solving problems we've known how to solve since the 1970s. The challenge is solving them as programming environments and user interfaces get more flexible and performant, and as the amount of code we have to secure increases at a rate that outpaces our ability to verify it. That's not the case with cryptography. In fact, if you include constructions along with underlying algorithms, it's difficult (I can't do it off the top of my head) to think of anything we use today that was secure in the 1970s. Most cryptography we use today wasn't widely available as recently as the 1990s --- not because nobody had invented the underlying basic concepts, but because the constructions that animated those concepts were terribly insecure.
  - rifung 10y ago
    Fully Homomorphic Encryption? I guess I don't know if that qualifies as being fundamental since it's very modern but it seems to be quite a popular topic right now.

Ar-Curunir 10y ago

ePrint is not necessarily the best indicator for such things, since essentially anybody can post there, but even so, from some random sampling it seems like more than a majority of papers are constructive and not about attacks.

tptacek 10y ago
Let's try this, instead: can you name some important fundamental theoretical work in cryptography that isn't defined by attacks? Obviously, that's a subjective judgement. Whatever you name though, we can just look and see how much of it is defined by attacker capabilities.
- Ar-Curunir 10y ago
  Zero knowledge proofs? Multiparty computation? These are the staples of theoretical crypto.
  - tptacek 10y ago
    Ok, let's say that those are. What's an important paper in either, so we can look at it more closely?
    - Ar-Curunir 10y ago
      The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. As I said earlier, tye majority of crypto research is in the following scenario: pinning down a battle-tested assumption, using that assumption in a provably secure manner to construct new systems. zero knowledge, MPC, ORAM, etc. all fall within this paradigm. Constructing new assumptions is obviously a task where attacks are necessary, but new assumptions come along every 5-7 years; the intervening period is dominated by this black box use of assumptions. EDIT: see this[1] listof most cited security and crypto papers; very few attack papers. [1] http://saweis.net/posts/most-cited-security-papers-2013-2014.html http://saweis.net/posts/most-cited-security-papers-2013-2014...
      - CiPHPerCoder 10y ago
        > The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Dave designs a ZKP protocol for a specific application. Jane finds a side-channel in the protocol that leaks some data about the secret being verified and publishes it. Is it still a zero knowledge proof? > Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. How do you prove security against stronger classes of adversaries without finding breaks in existing protocols, or at least trying to do so?
        Ar-Curunir 10y ago
        The property of being zero knowledge is entirely separate from properties of the implementation; side channels were simply absent from the original model. Either way, for every zero knowledge protocol, side channels are relevant only on the prover's side; verification cannot allow anyone to learn any information about the witness underlying the proof (other wise the proof is not zero knowledge). Sure, attacks can motivate some of the theory that is created, but most theory work only very loosely uses these attacks as motivation. A number of strengthening of the attack model are simply questions of curiosity: if we strengthened the threat model in this way, what guarantees do we have. Very rarely is it motivated by an actual attack.
        tptacek 10y ago
        At this point, I'm just going to say I take your point by stand by my own. Cryptography is unique among the disciplines we deal with in information security in being motivated entirely by attacks. In software engineering, we're solving problems we've known how to solve since the 1970s. The challenge is solving them as programming environments and user interfaces get more flexible and performant, and as the amount of code we have to secure increases at a rate that outpaces our ability to verify it. That's not the case with cryptography. In fact, if you include constructions along with underlying algorithms, it's difficult (I can't do it off the top of my head) to think of anything we use today that was secure in the 1970s. Most cryptography we use today wasn't widely available as recently as the 1990s --- not because nobody had invented the underlying basic concepts, but because the constructions that animated those concepts were terribly insecure.
- rifung 10y ago
  Fully Homomorphic Encryption? I guess I don't know if that qualifies as being fundamental since it's very modern but it seems to be quite a popular topic right now.