3 ms·

> Each team can then prove it is backdoored by providing (a significant part of) the plaintext. Some backdoors are asymmetric backdoor, so the original designe

> Each team can then prove it is backdoored by providing (a significant part of) the plaintext. Some backdoors are asymmetric backdoor, so the original designers can decrypt anything at will. But some others only hide a trick that reduces the computation complexity to, say, 2^80. Unless you are a nation-state, you cannot use the backdoor. And the other type of backdoor only increases the susceptibility to implementation vulnerabilities (cache-timing attacks, invalid curve attacks), mathematically speaking they're still secure, but too difficult for most people to implement it perfectly. A escrow process would be better.

throwawaymath 8y ago
> But some others only hide a trick that reduces the computation complexity to, say, 2^80. Unless you are a nation-state, you cannot use the backdoor. That's not an issue - you just publish the backdoor. You don't need to demonstrate the complexity reduction, you just need to prove it exists.
lucb1e 8y ago
If it can be 2^80, then with smaller parameters it can almost certainly be less as well. If it's so close to the real strength (e.g. 96 bits effective strength with 128 bits claimed), it's not really a practical backdoor anyway. That said, I see your point. I'm a fan of autograders and automation, but this can totally be solved by just submitting the solution, to be checked by people not in the jury.