3 ms·

That’s because other fields of computer science can either prove or demonstrate that their solution works. Cryptography almost never has solid proofs, and demon

That’s because other fields of computer science can either prove or demonstrate that their solution works. Cryptography almost never has solid proofs, and demonstrations prove nothing. When you’re working on something where “works great” and “completely broken” are almost indistinguishable, the only way to even have a hope of avoiding the second one is by having a lot of smart people bang on it for a long time.

Ar-Curunir 9y ago
What? Modern cryptography is based on proofs and definitions. Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that it resists certain kinds of attacks. Furthermore, assuming certain properties are satisfied by SHA2, we can order that different constructions based on it (eg a Merkle tree) are secure. Cryptography is highly mathematical.
- mikeash 9y ago
  I’m talking about proofs that the stuff works, i.e. that the algorithms or code are cryptographically strong. As far as I know, only the one-time pad has such a proof.
  - Ar-Curunir 9y ago
    As I said, proving that the underlying crypto is unbreakable would involving proving statements stronger than P≠NP, and so isn't going to happen for a while. What you can do is conjecture that your favourite hardness assumption (SHA-256 is a CRH, AES is a PRF, factorisation is not in P) holds, and then base your cryptographic constructions off such assumptions.
    - mikeash 9y ago
      I understand that. Starting with a conjecture and "proving" your algorithm's security based on that is not actually a solid proof. This is why things are the way I said they are.
- cycrutchfield 9y ago
  >Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that it resists certain kinds of attacks. Under very carefully chosen assumptions, which may or may not be true (hello Random Oracle). But this is a very flimsy sort of proof.

Ar-Curunir 9y ago

What? Modern cryptography is based on proofs and definitions. Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that it resists certain kinds of attacks. Furthermore, assuming certain properties are satisfied by SHA2, we can order that different constructions based on it (eg a Merkle tree) are secure. Cryptography is highly mathematical.

mikeash 9y ago
I’m talking about proofs that the stuff works, i.e. that the algorithms or code are cryptographically strong. As far as I know, only the one-time pad has such a proof.
- Ar-Curunir 9y ago
  As I said, proving that the underlying crypto is unbreakable would involving proving statements stronger than P≠NP, and so isn't going to happen for a while. What you can do is conjecture that your favourite hardness assumption (SHA-256 is a CRH, AES is a PRF, factorisation is not in P) holds, and then base your cryptographic constructions off such assumptions.
  - mikeash 9y ago
    I understand that. Starting with a conjecture and "proving" your algorithm's security based on that is not actually a solid proof. This is why things are the way I said they are.
cycrutchfield 9y ago
>Sure, we can't prove that SHA2 is cryptographically-strong (that imply P≠NP), but we can show that it resists certain kinds of attacks. Under very carefully chosen assumptions, which may or may not be true (hello Random Oracle). But this is a very flimsy sort of proof.