3 ms·

The secrets critical to the security of the system live on the end user devices: Ok so my desktop is device #1, and mobile is #2. I encrypt a note on desktop,

by homakov 10y ago

The secrets critical to the security of the system live on the end user devices: Ok so my desktop is device #1, and mobile is #2. I encrypt a note on desktop, then "query information, but the database operators cannot know what records have been requested" with device #2, it seems this concept fits to end-to-end definition you gave? I really think both terms are so vague that can be bended in a way that they look interchangeable. And nothing wrong about it.

hvidgaard 10y ago
They are two very different things. E2E is a term that dictates that when I send information, only the intented reciepient can decrypt it, under the assumption that the keys are safe. Zero knowledge proofs is a constuct where I can prove something to you, without leaking any information. For instance, you want to buy a house, but before the seller wants to sign, he wants proof that you can actually pay x $ in down payment. Traditionally you would go down to your bank, get a piece of paper stating that you have x $ locked and only usable for this purchage for the next 60 days. It doesn't say how much you have in your account, where the money is from or anything else. A zero knowledge proof is the same, just digital. E2E would not help here, because it doesn't prove anything, it's just a term about the comunication being safe.
- homakov 10y ago
  I know what you mean, ZK as in password auth. Then why in the first place encrypted storage was called zero knowledge? Complete misuse of the term.
  - hvidgaard 10y ago
    Not really. My example could just as well be done with any public key crypto system. If you want better examples, see the SO post https://mathoverflow.net/questions/22624/example-of-a-good-zero-knowledge-proof https://mathoverflow.net/questions/22624/example-of-a-good-z... But misuse of the term is most likely just because they didn't understand it in the first place. It is well defined, but rather abstract.
  - floatboth 10y ago
    Because if you encrypt data before uploading it to a server, the server has no (zero) knowledge about what that data is?
    - homakov 10y ago
      Best explanation https://paragonie.com/blog/2016/08/crypto-misnomers-zero-knowledge-considered-self-descriptive https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno...
Canada 10y ago
They're not mutually exclusive terms. You can have one without the other. The database that supports zero knowledge queries can be a plaintext patent database. You can do research without leaking what you're researching, however the records themselves are not confidential between a sender and recipient therefore it would be wrong to claim such a system is E2E, even though it is zero knowledge. Take your example, you upload 10 notes to a server with device #1 and then retrieve a few of them with device #2. The server knows exactly what 10 notes you uploaded and exactly which of 3 of the 10 were read by the second device. It also knows when the uploads and downloads occur. Since it knows #2 downloaded a subset of what #1 uploaded, it can conclude that #1 and #2 have some kind of relationship. (eg. Both are your devices, or one device belongs to your friend with whom you have shared 3 of your notes) This is E2E but not zero knowledge. Now imaging incorporating both E2E and zero knowledge techniques into a note sync system: 1) All notes are encrypted end to end. That is, the servers that store and route notes never learn the secrets necessary to decrypt them 2) Notes sent into the system are routed through a mixnet that uses verifiable shuffles so no one passively watching all of the users and system (or actively running malicious servers or clients) can learn who is sending which note ciphertext. 3) Note ciphertexts are retrieved from the system using private information retrieval so that observers and cheating servers don't learn who is receiving which one or when it's been received. This system isn't going to learn anything about how many devices you have or who you share with. And it's going to prevent further analysis of metadata: For example, device #1 and #2 keep matching sets of notes and they frequently connect from the same IP addresses, therefore it's safe to assume these devices are owned by the same person. Device #3 requests a subset of notes that were uploaded by #1 and #2, but always from a different country. Now #3 retrieves a note posted by #2 from the same IP address that #1 used recently. Therefore it's safe to assume that the owner of #3 is visiting the owner of #1 and #2.

by homakov 10y ago

hvidgaard 10y ago

They are two very different things. E2E is a term that dictates that when I send information, only the intented reciepient can decrypt it, under the assumption that the keys are safe. Zero knowledge proofs is a constuct where I can prove something to you, without leaking any information. For instance, you want to buy a house, but before the seller wants to sign, he wants proof that you can actually pay x $ in down payment. Traditionally you would go down to your bank, get a piece of paper stating that you have x $ locked and only usable for this purchage for the next 60 days. It doesn't say how much you have in your account, where the money is from or anything else. A zero knowledge proof is the same, just digital. E2E would not help here, because it doesn't prove anything, it's just a term about the comunication being safe.

homakov 10y ago
I know what you mean, ZK as in password auth. Then why in the first place encrypted storage was called zero knowledge? Complete misuse of the term.
- hvidgaard 10y ago
  Not really. My example could just as well be done with any public key crypto system. If you want better examples, see the SO post https://mathoverflow.net/questions/22624/example-of-a-good-zero-knowledge-proof https://mathoverflow.net/questions/22624/example-of-a-good-z... But misuse of the term is most likely just because they didn't understand it in the first place. It is well defined, but rather abstract.
- floatboth 10y ago
  Because if you encrypt data before uploading it to a server, the server has no (zero) knowledge about what that data is?
  - homakov 10y ago
    Best explanation https://paragonie.com/blog/2016/08/crypto-misnomers-zero-knowledge-considered-self-descriptive https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno...

Canada 10y ago

They're not mutually exclusive terms. You can have one without the other. The database that supports zero knowledge queries can be a plaintext patent database. You can do research without leaking what you're researching, however the records themselves are not confidential between a sender and recipient therefore it would be wrong to claim such a system is E2E, even though it is zero knowledge. Take your example, you upload 10 notes to a server with device #1 and then retrieve a few of them with device #2. The server knows exactly what 10 notes you uploaded and exactly which of 3 of the 10 were read by the second device. It also knows when the uploads and downloads occur. Since it knows #2 downloaded a subset of what #1 uploaded, it can conclude that #1 and #2 have some kind of relationship. (eg. Both are your devices, or one device belongs to your friend with whom you have shared 3 of your notes) This is E2E but not zero knowledge. Now imaging incorporating both E2E and zero knowledge techniques into a note sync system: 1) All notes are encrypted end to end. That is, the servers that store and route notes never learn the secrets necessary to decrypt them 2) Notes sent into the system are routed through a mixnet that uses verifiable shuffles so no one passively watching all of the users and system (or actively running malicious servers or clients) can learn who is sending which note ciphertext. 3) Note ciphertexts are retrieved from the system using private information retrieval so that observers and cheating servers don't learn who is receiving which one or when it's been received. This system isn't going to learn anything about how many devices you have or who you share with. And it's going to prevent further analysis of metadata: For example, device #1 and #2 keep matching sets of notes and they frequently connect from the same IP addresses, therefore it's safe to assume these devices are owned by the same person. Device #3 requests a subset of notes that were uploaded by #1 and #2, but always from a different country. Now #3 retrieves a note posted by #2 from the same IP address that #1 used recently. Therefore it's safe to assume that the owner of #3 is visiting the owner of #1 and #2.