4 ms·

Original poster (emphasis mine): > I have never met anyone who understands what cryptography is, and supports the FBI. Your reply: > I think (some of) what t

by iaw 9y ago

Original poster (emphasis mine): > I have never met anyone who understands what cryptography is, and supports the FBI. Your reply: > I think (some of) what the FBI is asking for lately is actually not that unreasonable -- assuming we could do it right. ... suppose we could construct a truly limited mechanism that would give them the ability to recover only a small amount of encrypted data. One precludes the other...

nyolfen 9y ago
i don't know about you but i'm willing to give the computer science professor who gave the presentation at a security conference the benefit of the doubt about understanding encryption
- philipwhiuk 9y ago
  He specifically says "assuming we could do it right." We can't.
  - cvwright 9y ago
    Math is hard. Let's go shopping!
  - Zigurd 9y ago
    Moreover he has no response to the question of how to scale the idea of "expensive to break" into even the near future. And then he is aggrieved and asks for "proof of impossibility" never mind the more fundamental problem with that ask, it's not something his suggestion even approaches needing. It's trivially insecure. He has done nothing to suggest that the assumption that "we could do it right" holds water. And who is "we?" Even "we" is a tendentious notion.
    - cvwright 9y ago
      > how to scale the idea of "expensive to break" into even the near future This part isn't actually that hard. Suppose your computation costs $1M now, and Moore's Law continues doubling computation per watt every 18 months for the foreseeable future. Then in 15 years, the same computation will cost 1/1024 as much as it does today. So you're paying about $1000 per message for 15-year-old data. In 30 years, you'll be paying about $1 per message for 30-year-old data. Is that good enough? It totally depends. For most messages, it's almost certainly fine, because the value of the message decays over time. For other messages that hold their value, you need to set the initial cost higher. The formula above shows how you could that to achieve a certain cost at a time a certain number of years in the future. As to the rest of your comment - this is not how we do science (or engineering). If we cried and gave up every time we encountered a hard problem, we'd still be living in caves, hitting each other with rocks.
      - Zigurd 9y ago
        You can't predict the future of computation. Look at the cost curve of Bitcoin mining. You may say you ("you" not "we") will learn from that. You are suggesting it's ok to trust your assessment of encryption strength. Show me a multi-decades track record of your predictions holding up when cryptographers designing secure systems don't have such a track record. Your idea amounts to Russian roulette where the gun gets more bullets over time.
        cvwright 9y ago
        > You can't predict the future of computation. Yes and no. Can we predict it exactly? Of course not. But we can estimate the rough order of magnitude with high confidence. It's not hard to find charts showing transistor density over time, and Moore's Law holds up pretty well since the 1970s. If anything, the two big changes on the horizon are (1) quantum computers and (2) the end of Moore's Law. (1) is really hard to predict, and it will make all our current techniques vulnerable anyway. When (2) finally happens, it will only make future predictions easier, not harder. > Look at the cost curve of Bitcoin mining. Sure. Mining was expensive, so people put in a lot of work to make it more efficient. Now it's more efficient, but the easy optimizations are gone. ASIC miners are something like 20000x more efficient than recent CPUs. Do you really think there's another 10000x hiding in there? 1000x? 100x? For comparison, AsicBoost was (is?) regarded this huge big deal, and it only yields about 37% improvement in mining efficiency. > Show me a multi-decades track record ... when cryptographers designing secure systems don't have such a track record. I know this is not quite what you asked for, but you don't have to look very far to find an encryption primitive that has "stood the test of time" cryptanalytically. It's called DES, and it's older than most people posting here. The only reason we don't use it now is because it uses tiny little keys that can be efficiently brute-forced. https://en.wikipedia.org/wiki/Data_Encryption_Standard https://en.wikipedia.org/wiki/Data_Encryption_Standard Its replacement, AES, is now 20 years old and is holding up comparably well. https://en.wikipedia.org/wiki/Advanced_Encryption_Standard https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
        Zigurd 9y ago
anfedorov 9y ago
What do you think corporations do to their corporate laptop disk encryption? Have only the employee be able to access it?
cvwright 9y ago
> One precludes the other... That's quite insulting. Personally, I'm getting a bit tired of hearing "lol nerd harder! It's impossible!" from people who can't even spell IND-CPA. (Not saying that you are one of those. Just that there are a lot of them around.) If it's really impossible, then somebody needs to show up with a proof of impossibility.
- naasking 9y ago
  If it's a matter of a backdoor/special key the FBI must keep secret, it will leak, period. Then what? If it's a matter of having the computing resources to crack a key, then people's computers are too easily compromised to act as bots to solve any such problem. Our computing infrastructure is simply too vulnerable. To avoid this scenario, you'd have to secure every operating system in the world in a way that they could not be compromised, even in principle. That's as close to a proof as should be needed, unless there's a compelling counterargument to suspect some assumption is false. I have yet to hear such an argument.
  - tptacek 9y ago
    It will leak, period? What's the Dual EC private key?
    - naasking 9y ago
      1. "I'm not aware of it having happened, therefore it has not and will not happen". I won't even bother listing all the fallacies in that position. 2. Dual EC isn't protecting anything of value, and hasn't in about 15 years. If your reply is meant to be pedantic about my phrasing, notice that the context is about encryption that is actually in use.
      - tptacek 9y ago
        It's not protecting anything of value, you mean, besides every VPN session generated by the most important vendor of hardware VPNs in the industry prior to 2016?

by iaw 9y ago

nyolfen 9y ago

i don't know about you but i'm willing to give the computer science professor who gave the presentation at a security conference the benefit of the doubt about understanding encryption

philipwhiuk 9y ago
He specifically says "assuming we could do it right." We can't.
- cvwright 9y ago
  Math is hard. Let's go shopping!
- Zigurd 9y ago
  Moreover he has no response to the question of how to scale the idea of "expensive to break" into even the near future. And then he is aggrieved and asks for "proof of impossibility" never mind the more fundamental problem with that ask, it's not something his suggestion even approaches needing. It's trivially insecure. He has done nothing to suggest that the assumption that "we could do it right" holds water. And who is "we?" Even "we" is a tendentious notion.
  - cvwright 9y ago
    > how to scale the idea of "expensive to break" into even the near future This part isn't actually that hard. Suppose your computation costs $1M now, and Moore's Law continues doubling computation per watt every 18 months for the foreseeable future. Then in 15 years, the same computation will cost 1/1024 as much as it does today. So you're paying about $1000 per message for 15-year-old data. In 30 years, you'll be paying about $1 per message for 30-year-old data. Is that good enough? It totally depends. For most messages, it's almost certainly fine, because the value of the message decays over time. For other messages that hold their value, you need to set the initial cost higher. The formula above shows how you could that to achieve a certain cost at a time a certain number of years in the future. As to the rest of your comment - this is not how we do science (or engineering). If we cried and gave up every time we encountered a hard problem, we'd still be living in caves, hitting each other with rocks.
    - Zigurd 9y ago
      You can't predict the future of computation. Look at the cost curve of Bitcoin mining. You may say you ("you" not "we") will learn from that. You are suggesting it's ok to trust your assessment of encryption strength. Show me a multi-decades track record of your predictions holding up when cryptographers designing secure systems don't have such a track record. Your idea amounts to Russian roulette where the gun gets more bullets over time.
      - cvwright 9y ago
        > You can't predict the future of computation. Yes and no. Can we predict it exactly? Of course not. But we can estimate the rough order of magnitude with high confidence. It's not hard to find charts showing transistor density over time, and Moore's Law holds up pretty well since the 1970s. If anything, the two big changes on the horizon are (1) quantum computers and (2) the end of Moore's Law. (1) is really hard to predict, and it will make all our current techniques vulnerable anyway. When (2) finally happens, it will only make future predictions easier, not harder. > Look at the cost curve of Bitcoin mining. Sure. Mining was expensive, so people put in a lot of work to make it more efficient. Now it's more efficient, but the easy optimizations are gone. ASIC miners are something like 20000x more efficient than recent CPUs. Do you really think there's another 10000x hiding in there? 1000x? 100x? For comparison, AsicBoost was (is?) regarded this huge big deal, and it only yields about 37% improvement in mining efficiency. > Show me a multi-decades track record ... when cryptographers designing secure systems don't have such a track record. I know this is not quite what you asked for, but you don't have to look very far to find an encryption primitive that has "stood the test of time" cryptanalytically. It's called DES, and it's older than most people posting here. The only reason we don't use it now is because it uses tiny little keys that can be efficiently brute-forced. https://en.wikipedia.org/wiki/Data_Encryption_Standard https://en.wikipedia.org/wiki/Data_Encryption_Standard Its replacement, AES, is now 20 years old and is holding up comparably well. https://en.wikipedia.org/wiki/Advanced_Encryption_Standard https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
        Zigurd 9y ago

anfedorov 9y ago

What do you think corporations do to their corporate laptop disk encryption? Have only the employee be able to access it?

cvwright 9y ago

> One precludes the other... That's quite insulting. Personally, I'm getting a bit tired of hearing "lol nerd harder! It's impossible!" from people who can't even spell IND-CPA. (Not saying that you are one of those. Just that there are a lot of them around.) If it's really impossible, then somebody needs to show up with a proof of impossibility.

naasking 9y ago
If it's a matter of a backdoor/special key the FBI must keep secret, it will leak, period. Then what? If it's a matter of having the computing resources to crack a key, then people's computers are too easily compromised to act as bots to solve any such problem. Our computing infrastructure is simply too vulnerable. To avoid this scenario, you'd have to secure every operating system in the world in a way that they could not be compromised, even in principle. That's as close to a proof as should be needed, unless there's a compelling counterargument to suspect some assumption is false. I have yet to hear such an argument.
- tptacek 9y ago
  It will leak, period? What's the Dual EC private key?
  - naasking 9y ago
    1. "I'm not aware of it having happened, therefore it has not and will not happen". I won't even bother listing all the fallacies in that position. 2. Dual EC isn't protecting anything of value, and hasn't in about 15 years. If your reply is meant to be pedantic about my phrasing, notice that the context is about encryption that is actually in use.
    - tptacek 9y ago
      It's not protecting anything of value, you mean, besides every VPN session generated by the most important vendor of hardware VPNs in the industry prior to 2016?