4 ms·

Public key verification is ultimately needed in all end-to-end encryption systems to offer a strong guarantee that the conversation is not subverted by a man-in

Public key verification is ultimately needed in all end-to-end encryption systems to offer a strong guarantee that the conversation is not subverted by a man-in-the-middle attacker. If can be done by using the Socialist Millionaire Protocol (https://en.wikipedia.org/wiki/Socialist_millionaires https://en.wikipedia.org/wiki/Socialist_millionaires) and a shared secret, but more often the verification is arranged in-person, out-of-band, manually. As realtime, realistic voice synthesize is thought to be difficult, a voice/phone call encryption system usually circumvents this problem by using the caller's voice as the proof, as both recognize each other's voice. In most phone encryption systems, like many commercial systems, or the ZRTP protocol by Phil Zimmermann, or the "safety number" in Signal, they allow both parties to read out their pubkey's SHA-256 hash digest (usually encoded to words) aloud, as a mean of verification. If this type of AI-based voice synthesizer becomes widely-available, it could be disastrous to cryptography. It is not the end-of-the-world of course, as targeted attack with social engineering is not an issue for most people, and those who need this level of security is going to perform out-of-band exchange anyway, but still, the certainty of voice-based key verification would be greatly weakened.

beguiledfoil 8y ago
Cryptography doesn't solve social problems. Cryptography doesn't solve political problems. Cryptography solves communication problems. That's. It.
- emiliobumachar 8y ago
  Being sure that it's really my son talking to me over the phone is primarily a communication problem, no? The social and political implications are quite large, but they can be addressed by solving the communication problem. This can involve crypto. Or am I missing something? (I say nothing for or against the particular scheme proposed by gp, just against parent's implied generalized dismissal of crypto to solve this problem)
  - bcaa7f3a8bbc 8y ago
    Agree. I was just talking about a pure technical issue of voice synthesize, and its implications to voice encryption. In other words, a communication-over-the-phone problem. I didn't mention nor intended to talk from a political or social perspective. While I understand the parent comment's stance that cryptography is not the magic sauce, I don't think it's related to my comment.
- eric_bullington 8y ago
  Cryptography can solve social problems, but the problems need to be approached from a social perspective, not a computer science perspective. There's a hint of this type of approach in the work of Keybase.

beguiledfoil 8y ago

Cryptography doesn't solve social problems. Cryptography doesn't solve political problems. Cryptography solves communication problems. That's. It.

emiliobumachar 8y ago
Being sure that it's really my son talking to me over the phone is primarily a communication problem, no? The social and political implications are quite large, but they can be addressed by solving the communication problem. This can involve crypto. Or am I missing something? (I say nothing for or against the particular scheme proposed by gp, just against parent's implied generalized dismissal of crypto to solve this problem)
- bcaa7f3a8bbc 8y ago
  Agree. I was just talking about a pure technical issue of voice synthesize, and its implications to voice encryption. In other words, a communication-over-the-phone problem. I didn't mention nor intended to talk from a political or social perspective. While I understand the parent comment's stance that cryptography is not the magic sauce, I don't think it's related to my comment.
eric_bullington 8y ago
Cryptography can solve social problems, but the problems need to be approached from a social perspective, not a computer science perspective. There's a hint of this type of approach in the work of Keybase.