4 ms·

> The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Dave designs a ZKP protocol fo

> The very foundational paper for zero knowledge did not have much to do with attacks. Similarly for many many subsequent works. Dave designs a ZKP protocol for a specific application. Jane finds a side-channel in the protocol that leaks some data about the secret being verified and publishes it. Is it still a zero knowledge proof? > Similarly for MPC. Most work in MPC is about improving efficiency or proving security against stronger classes of adversaries; it is not in finding breaks of these protocols. How do you prove security against stronger classes of adversaries without finding breaks in existing protocols, or at least trying to do so?

Ar-Curunir 10y ago
The property of being zero knowledge is entirely separate from properties of the implementation; side channels were simply absent from the original model. Either way, for every zero knowledge protocol, side channels are relevant only on the prover's side; verification cannot allow anyone to learn any information about the witness underlying the proof (other wise the proof is not zero knowledge). Sure, attacks can motivate some of the theory that is created, but most theory work only very loosely uses these attacks as motivation. A number of strengthening of the attack model are simply questions of curiosity: if we strengthened the threat model in this way, what guarantees do we have. Very rarely is it motivated by an actual attack.
- tptacek 10y ago
  At this point, I'm just going to say I take your point by stand by my own. Cryptography is unique among the disciplines we deal with in information security in being motivated entirely by attacks. In software engineering, we're solving problems we've known how to solve since the 1970s. The challenge is solving them as programming environments and user interfaces get more flexible and performant, and as the amount of code we have to secure increases at a rate that outpaces our ability to verify it. That's not the case with cryptography. In fact, if you include constructions along with underlying algorithms, it's difficult (I can't do it off the top of my head) to think of anything we use today that was secure in the 1970s. Most cryptography we use today wasn't widely available as recently as the 1990s --- not because nobody had invented the underlying basic concepts, but because the constructions that animated those concepts were terribly insecure.
  - Ar-Curunir 10y ago
    But that's what I'm saying; there is lots of cryptography that is entirely unmotivated by attacks, like: work on determining the size of complexity classes like CZK and SZK; Determining lower bounds of round complexity of MPC in various models; Determining the kinds of assumptions different primitives can be based upon; Determining the complexity classes supported by different delegation of computation schemes, and the assumptions these can be based on; Determining whether you can obtain particular primitives out of others, such as OWPs from OWFs in a non blackbox manner, seeing what iO can be used for, etc; Improving asymptotic efficiency of various primitives, like NIZKs (see SNARKs). I think the difference in our viewpoints comes from the communities we're; I'm in the theoretical, rooted in complexity theory side of things, whereas you appear to be on the more applied side of crypto, given your emphasis on things that are being used in practice.
deleted 10y ago
[deleted]

Ar-Curunir 10y ago

The property of being zero knowledge is entirely separate from properties of the implementation; side channels were simply absent from the original model. Either way, for every zero knowledge protocol, side channels are relevant only on the prover's side; verification cannot allow anyone to learn any information about the witness underlying the proof (other wise the proof is not zero knowledge). Sure, attacks can motivate some of the theory that is created, but most theory work only very loosely uses these attacks as motivation. A number of strengthening of the attack model are simply questions of curiosity: if we strengthened the threat model in this way, what guarantees do we have. Very rarely is it motivated by an actual attack.

tptacek 10y ago
At this point, I'm just going to say I take your point by stand by my own. Cryptography is unique among the disciplines we deal with in information security in being motivated entirely by attacks. In software engineering, we're solving problems we've known how to solve since the 1970s. The challenge is solving them as programming environments and user interfaces get more flexible and performant, and as the amount of code we have to secure increases at a rate that outpaces our ability to verify it. That's not the case with cryptography. In fact, if you include constructions along with underlying algorithms, it's difficult (I can't do it off the top of my head) to think of anything we use today that was secure in the 1970s. Most cryptography we use today wasn't widely available as recently as the 1990s --- not because nobody had invented the underlying basic concepts, but because the constructions that animated those concepts were terribly insecure.
- Ar-Curunir 10y ago
  But that's what I'm saying; there is lots of cryptography that is entirely unmotivated by attacks, like: work on determining the size of complexity classes like CZK and SZK; Determining lower bounds of round complexity of MPC in various models; Determining the kinds of assumptions different primitives can be based upon; Determining the complexity classes supported by different delegation of computation schemes, and the assumptions these can be based on; Determining whether you can obtain particular primitives out of others, such as OWPs from OWFs in a non blackbox manner, seeing what iO can be used for, etc; Improving asymptotic efficiency of various primitives, like NIZKs (see SNARKs). I think the difference in our viewpoints comes from the communities we're; I'm in the theoretical, rooted in complexity theory side of things, whereas you appear to be on the more applied side of crypto, given your emphasis on things that are being used in practice.

deleted 10y ago

[deleted]