6 ms·

There's nothing Zero Knowledge about this. I'm starting to think that Spider Oak has destroyed the meaning of the term. Apparently Zero knowledge now means E2E

by Canada 10y ago

There's nothing Zero Knowledge about this. I'm starting to think that Spider Oak has destroyed the meaning of the term. Apparently Zero knowledge now means E2E.

dredmorbius 10y ago
If the system relies on user Peggy demonstrating to service Victor that Peggy knows the keys that decrypt or access information, then the system approaches the traditional meaning of "zero knowledge". (Peggy being Prover and Victor being Verifier, see the ZKP Wikpedia page.) If the system can work with Victor knowing anything else about Peggy, e.g., entirely taking the question "who are you" out of the equation, well, then, we've got an interesting situation.
- Canada 10y ago
  If Alice can share notes with Bob in a manner where the service itself cannot determine that Alice and Bob have any connection at all, then go ahead and market that as Zero Knowledge. If the service can determine who is talking to who, though either passive or active means, then it is disingenuous to claim the service is Zero Knowledge. Unless the anonymity set is very small or bandwidth is infinite, accomplishing metadata privacy requires some kind of zero knowledge proof. I don't think such systems necessarily require E2E encryption. If the term zero knowledge continues to be misused, it's going to cause more confusion later when services get around to protecting metadata.
  - dredmorbius 10y ago
    Fair points. I've misused the term myself (in ignorance), and can see how this could easily get transformed by a nonexpert public.
xvolter 10y ago
I definitely think that cryptpad.fr doesn't know the meaning. Keybase's entire purpose is to make a public database of people. They know who you are, therefore, they have some knowledge. Not that complicated. If you store user profile data and therefore link the data they store to that profile, it is not zero knowledge. Arguably, if you have to charge money for a service, you might need a way to do that, but then you're not zero knowledge. Or you just a flat rate with unlimited of whatever your service provides. I don't think it makes a lot of sense to trust a company that claims to be secure when they don't understand even the terminology, let along the complexities, of providing security and privacy.
jboynyc 10y ago
Before Spideroak started (ab)using the term in this way, the password manager Clipperz did as well. However, they saw the error of their ways and switched from "zero-knowledge web apps" to "host-proof web apps," which arguably is a better concept. Unfortunately, it never caught on and seems to have died out as Clipperz stopped being actively developed. Spider Oak has also dropped the term and now goes with "no knowledge." https://clipperz.is/about/#why-web-cryptography-does-matter https://clipperz.is/about/#why-web-cryptography-does-matter https://en.wikipedia.org/wiki/SpiderOak#History https://en.wikipedia.org/wiki/SpiderOak#History
homakov 10y ago
Isn't zero-knowledge a subset of end-to-end (where both ends are you)
- Canada 10y ago
  No, it's not.
  - homakov 10y ago
    Well, who decides what it is? When security words go marketing, it's pointless to argue. Zero knowledge is yet another "military grade" buzzword.
    - Canada 10y ago
      You're right that marketing can sometimes make what was once black into white, but that doesn't make it true. A phrase like "military grade" is now and was always a meaningless, nonsense phrase used to suggest robustness. No military has actually defined any "grade" of encryption to measure with. It's like saying that your ladies deodorant is "Strong Enough For a Man". Sure, whatever. End to end encryption (E2E) on the other hand means something specific: The secrets critical to the security of the system live on the end user devices. If a standard webmail service claims to be E2E, it's not marketing, it's lying. Likewise, zero knowledge has a well defined meaning. It's a protocol where a Prover convinces a Verifier that it has some information, without actually revealing what that information is. For example, Peggy could have a set of public keys, whose order she has randomly shuffled. She can prove to Victor that the output of her Shuffle is a valid permutation of the keys, without revealing to Victor what order they were in before she shuffled them. Zero knowledge protocols are useful building blocks for such tasks as: - Mixing messages in a way that prevents a global passive adversary who also maliciously runs some of the routers in a network from learning the social graph of users (Tor cannot do this, because it is not zero knowledge) - Verifiable secret ballots. Voting systems where you receive proof that your ballot was cast as you intended, but you can't use the proof to convince anyone else. (To mitigate vote buying/voter intimidation) - Offering a database where users can query information, but the database operators cannot know what records have been requested If a product doesn't provide such features, or doesn't make use of a zero knowledge proof, then calling it zero knowledge is nothing more than a brazen lie.
CiPHPerCoder 10y ago
Any time anyone misuses "zero knowledge", please direct them to this page: https://paragonie.com/blog/2016/08/crypto-misnomers-zero-knowledge-considered-self-descriptive https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno...

by Canada 10y ago

There's nothing Zero Knowledge about this. I'm starting to think that Spider Oak has destroyed the meaning of the term. Apparently Zero knowledge now means E2E.

dredmorbius 10y ago

If the system relies on user Peggy demonstrating to service Victor that Peggy knows the keys that decrypt or access information, then the system approaches the traditional meaning of "zero knowledge". (Peggy being Prover and Victor being Verifier, see the ZKP Wikpedia page.) If the system can work with Victor knowing anything else about Peggy, e.g., entirely taking the question "who are you" out of the equation, well, then, we've got an interesting situation.

Canada 10y ago
If Alice can share notes with Bob in a manner where the service itself cannot determine that Alice and Bob have any connection at all, then go ahead and market that as Zero Knowledge. If the service can determine who is talking to who, though either passive or active means, then it is disingenuous to claim the service is Zero Knowledge. Unless the anonymity set is very small or bandwidth is infinite, accomplishing metadata privacy requires some kind of zero knowledge proof. I don't think such systems necessarily require E2E encryption. If the term zero knowledge continues to be misused, it's going to cause more confusion later when services get around to protecting metadata.
- dredmorbius 10y ago
  Fair points. I've misused the term myself (in ignorance), and can see how this could easily get transformed by a nonexpert public.

xvolter 10y ago

I definitely think that cryptpad.fr doesn't know the meaning. Keybase's entire purpose is to make a public database of people. They know who you are, therefore, they have some knowledge. Not that complicated. If you store user profile data and therefore link the data they store to that profile, it is not zero knowledge. Arguably, if you have to charge money for a service, you might need a way to do that, but then you're not zero knowledge. Or you just a flat rate with unlimited of whatever your service provides. I don't think it makes a lot of sense to trust a company that claims to be secure when they don't understand even the terminology, let along the complexities, of providing security and privacy.

jboynyc 10y ago

Before Spideroak started (ab)using the term in this way, the password manager Clipperz did as well. However, they saw the error of their ways and switched from "zero-knowledge web apps" to "host-proof web apps," which arguably is a better concept. Unfortunately, it never caught on and seems to have died out as Clipperz stopped being actively developed. Spider Oak has also dropped the term and now goes with "no knowledge." https://clipperz.is/about/#why-web-cryptography-does-matter https://clipperz.is/about/#why-web-cryptography-does-matter https://en.wikipedia.org/wiki/SpiderOak#History https://en.wikipedia.org/wiki/SpiderOak#History

homakov 10y ago

Isn't zero-knowledge a subset of end-to-end (where both ends are you)

Canada 10y ago
No, it's not.
- homakov 10y ago
  Well, who decides what it is? When security words go marketing, it's pointless to argue. Zero knowledge is yet another "military grade" buzzword.
  - Canada 10y ago
    You're right that marketing can sometimes make what was once black into white, but that doesn't make it true. A phrase like "military grade" is now and was always a meaningless, nonsense phrase used to suggest robustness. No military has actually defined any "grade" of encryption to measure with. It's like saying that your ladies deodorant is "Strong Enough For a Man". Sure, whatever. End to end encryption (E2E) on the other hand means something specific: The secrets critical to the security of the system live on the end user devices. If a standard webmail service claims to be E2E, it's not marketing, it's lying. Likewise, zero knowledge has a well defined meaning. It's a protocol where a Prover convinces a Verifier that it has some information, without actually revealing what that information is. For example, Peggy could have a set of public keys, whose order she has randomly shuffled. She can prove to Victor that the output of her Shuffle is a valid permutation of the keys, without revealing to Victor what order they were in before she shuffled them. Zero knowledge protocols are useful building blocks for such tasks as: - Mixing messages in a way that prevents a global passive adversary who also maliciously runs some of the routers in a network from learning the social graph of users (Tor cannot do this, because it is not zero knowledge) - Verifiable secret ballots. Voting systems where you receive proof that your ballot was cast as you intended, but you can't use the proof to convince anyone else. (To mitigate vote buying/voter intimidation) - Offering a database where users can query information, but the database operators cannot know what records have been requested If a product doesn't provide such features, or doesn't make use of a zero knowledge proof, then calling it zero knowledge is nothing more than a brazen lie.

CiPHPerCoder 10y ago

Any time anyone misuses "zero knowledge", please direct them to this page: https://paragonie.com/blog/2016/08/crypto-misnomers-zero-knowledge-considered-self-descriptive https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno...