5 ms·

> For decades, computer scientists wondered if there is any secure, all-encompassing way to obfuscate computer programs, allowing people to use them without fig

> For decades, computer scientists wondered if there is any secure, all-encompassing way to obfuscate computer programs, allowing people to use them without figuring out their internal secrets. As someone who works in cryptography, this isn't "The Crown Jewel" of Cryptography. Cryptography to me is about helping queer people live their best life even in countries where they're hated. Cryptography to me is about providing assurance that the software you're running was produced by the people you thought produced it, and that the built binary is reproducible from the source code, which technical people can also inspect to assert the absence of backdoors. Obfuscation and copy-protection are non-goals for me. Fully homomorphic encryption has uses in machine learning and cloud services, but I find them at odds with the goals I care about.

bawolff 6y ago
Arguably aren't those security engineering goals more than cryptography goals?
- some_furry 6y ago
  I'm really not interested in splitting hairs over taxonomy. Real-world cryptography and security engineering intersect a lot.
  - bawolff 6y ago
    i would call both of those the same thing, and neither of them are cryptography.
    - some_furry 6y ago
      Is your argument "real-world cryptography isn't cryptography", or am I misunderstanding? EDIT: I can't reply due to rate-limiting, so here's my reply to your reply below: ----- > My argument is "real world cryptography" is a euphamism for security engineering for people who want to sound more badass. It's not a euphemism. Take a look at the accepted papers at the aptly named Real World Cryptography symposiums: https://rwc.iacr.org/2020/program.html https://rwc.iacr.org/2020/program.html Breaks on OCB2. Lattice attacks on TPMs. MPC research. Privacy-preserving telemetry. I'll accept that you may personally have only seen security engineering work under the guise of "real-world cryptography", but to call it a euphemism is erroneous. ----- > Well if someone wrote an article about the Poincaré conjecture calling it the "crown jewel" of math, and someone else said "actually I consider the primary goal of math to be in helping build low-cost housing and other practical issues," then they're talking about two different things. Both are math, but to say that the Poincaré conjecture isn't important to math because you use math primarily for different things is misleading. All of the proposals for homomorphic encryption I've seen to date (which, for transparency, were mostly in the realm of encrypted databases) don't provide any protection against chosen-ciphertext attacks. If [F]HE isn't IND-CCA2 secure, which is the minimum bar for encryption that should be used outside of academic settings, then calling it the crown jewel only serves to hype up a technology that will fail to protect users.
      - bawolff 6y ago
        My argument is "real world cryptography" is a euphamism for security engineering for people who want to sound more badass. Making an app with encryption has about as much to do with cryptography as making a react app has to do with turing machines. Don't get me wrong, its important work, but lets not pretend its remotely the same type of work.
      - bccdee 6y ago
        Well if someone wrote an article about the Poincaré conjecture calling it the "crown jewel" of math, and someone else said "actually I consider the primary goal of math to be in helping build low-cost housing and other practical issues," then they're talking about two different things. Both are math, but to say that the Poincaré conjecture isn't important to math because you use math primarily for different things is misleading.
      - Ar-Curunir 6y ago
        Re: IND-CCA2 security for FHE; you can have constructions which achieve it in suitably (Eg from iO: https://cybersecurity.springeropen.com/articles/10.1186/s42400-018-0013-8 https://cybersecurity.springeropen.com/articles/10.1186/s424...). But in general the goal of FHE is at odds with CCA2 security. The latter requires non-malleability, but the point of FHE is to malleate the ciphertext in useful ways.
      - aruss 6y ago
        FHE can be made IND-CCA secure in practice (i.e. for specific systems), please stop spreading misinformation. It's impossible in the general case for obvious reasons. Also, TFA isn't about FHE, it's about iO. I know and have worked with the organizers of RWC and they've done a lot of the kind of work that you're dismissing here (which would be like telling Diffie and Hellman to piss off in the 70s because public-key crypto isn't IND-CCA2 secure without additional assumptions).
        some_furry 6y ago
        > I know and have worked with the organizers of RWC and they've done a lot of the kind of work that you're dismissing here (which would be like telling Diffie and Hellman to piss off in the 70s because public-key crypto isn't IND-CCA2 secure without additional assumptions). I'm decrying the sensationalist writing in this news story, especially the headline, not dismissing anyone's work. Maybe should ask your RWC organizer friends if your take is proportional to what I'm doing.
hacknat 6y ago
This is a pretty cynical take. I don't think we can possibly foresee all the advances that practical fully homomorphic encryption could provide. It could make it easier for under siege communities in repressed 3rd world countries to run fully online programs that can't be shutdown or blocked. There are numerous ways in which it could be helpful or harmful. The point is that we don't know what's going to come out ahead of time.
- some_furry 6y ago
  > It could make it easier for under siege communities in repressed 3rd world countries to run fully online programs that can't be shutdown or blocked. How can you expect people being targeted by hostile nation states to trust obfuscated closed-source software to protect them from said nation states? Binary obfuscation techniques to evade signature detection are a dime a dozen. The only time this intersects with homomorphic encryption is when you're dealing with DRM and other privacy-adverse technologies.
  - hacknat 6y ago
    > Binary obfuscation techniques to evade signature detection are a dime a dozen. Fully encrypted programs that can perform and can run on an untrusted platform are not. I think you may have a little more reading to do.
    - some_furry 6y ago
      Fully encrypted programs can do things without the end user having any way of verifying that they're not backdoored or behaving otherwise maliciously. (As a reminder, I'm not saying that FHE is inherently harmful. I take issue with their marketing spin on FHE as the "Crowl Jewel" is all. The motivations for companies to develop FHE are almost always in line with DRM, which is strictly speaking adverse to user freedom.)
Ar-Curunir 6y ago
It would be good to clarify that this article (and quanta in general) is about the theoretical side of cryptography, which often has little overlap with applications of cryptography, especially when you're at the cutting edge of theoretical research like this work is. However, that doesn't mean that iO isn't useful for tasks that you might care about. For example, * deniable encryption (https://eprint.iacr.org/2013/454.pdf https://eprint.iacr.org/2013/454.pdf), * better constructions of post-quantum NIZKs (which can help with ensuring that a remote server is behaving honestly), * proving results about the hardness of finding Nash equilibria (https://ieeexplore.ieee.org/abstract/document/7354468 https://ieeexplore.ieee.org/abstract/document/7354468)

bawolff 6y ago

Arguably aren't those security engineering goals more than cryptography goals?

some_furry 6y ago
I'm really not interested in splitting hairs over taxonomy. Real-world cryptography and security engineering intersect a lot.
- bawolff 6y ago
  i would call both of those the same thing, and neither of them are cryptography.
  - some_furry 6y ago
    Is your argument "real-world cryptography isn't cryptography", or am I misunderstanding? EDIT: I can't reply due to rate-limiting, so here's my reply to your reply below: ----- > My argument is "real world cryptography" is a euphamism for security engineering for people who want to sound more badass. It's not a euphemism. Take a look at the accepted papers at the aptly named Real World Cryptography symposiums: https://rwc.iacr.org/2020/program.html https://rwc.iacr.org/2020/program.html Breaks on OCB2. Lattice attacks on TPMs. MPC research. Privacy-preserving telemetry. I'll accept that you may personally have only seen security engineering work under the guise of "real-world cryptography", but to call it a euphemism is erroneous. ----- > Well if someone wrote an article about the Poincaré conjecture calling it the "crown jewel" of math, and someone else said "actually I consider the primary goal of math to be in helping build low-cost housing and other practical issues," then they're talking about two different things. Both are math, but to say that the Poincaré conjecture isn't important to math because you use math primarily for different things is misleading. All of the proposals for homomorphic encryption I've seen to date (which, for transparency, were mostly in the realm of encrypted databases) don't provide any protection against chosen-ciphertext attacks. If [F]HE isn't IND-CCA2 secure, which is the minimum bar for encryption that should be used outside of academic settings, then calling it the crown jewel only serves to hype up a technology that will fail to protect users.
    - bawolff 6y ago
      My argument is "real world cryptography" is a euphamism for security engineering for people who want to sound more badass. Making an app with encryption has about as much to do with cryptography as making a react app has to do with turing machines. Don't get me wrong, its important work, but lets not pretend its remotely the same type of work.
    - bccdee 6y ago
      Well if someone wrote an article about the Poincaré conjecture calling it the "crown jewel" of math, and someone else said "actually I consider the primary goal of math to be in helping build low-cost housing and other practical issues," then they're talking about two different things. Both are math, but to say that the Poincaré conjecture isn't important to math because you use math primarily for different things is misleading.
    - Ar-Curunir 6y ago
      Re: IND-CCA2 security for FHE; you can have constructions which achieve it in suitably (Eg from iO: https://cybersecurity.springeropen.com/articles/10.1186/s42400-018-0013-8 https://cybersecurity.springeropen.com/articles/10.1186/s424...). But in general the goal of FHE is at odds with CCA2 security. The latter requires non-malleability, but the point of FHE is to malleate the ciphertext in useful ways.
    - aruss 6y ago
      FHE can be made IND-CCA secure in practice (i.e. for specific systems), please stop spreading misinformation. It's impossible in the general case for obvious reasons. Also, TFA isn't about FHE, it's about iO. I know and have worked with the organizers of RWC and they've done a lot of the kind of work that you're dismissing here (which would be like telling Diffie and Hellman to piss off in the 70s because public-key crypto isn't IND-CCA2 secure without additional assumptions).
      - some_furry 6y ago
        > I know and have worked with the organizers of RWC and they've done a lot of the kind of work that you're dismissing here (which would be like telling Diffie and Hellman to piss off in the 70s because public-key crypto isn't IND-CCA2 secure without additional assumptions). I'm decrying the sensationalist writing in this news story, especially the headline, not dismissing anyone's work. Maybe should ask your RWC organizer friends if your take is proportional to what I'm doing.

hacknat 6y ago

This is a pretty cynical take. I don't think we can possibly foresee all the advances that practical fully homomorphic encryption could provide. It could make it easier for under siege communities in repressed 3rd world countries to run fully online programs that can't be shutdown or blocked. There are numerous ways in which it could be helpful or harmful. The point is that we don't know what's going to come out ahead of time.

some_furry 6y ago
> It could make it easier for under siege communities in repressed 3rd world countries to run fully online programs that can't be shutdown or blocked. How can you expect people being targeted by hostile nation states to trust obfuscated closed-source software to protect them from said nation states? Binary obfuscation techniques to evade signature detection are a dime a dozen. The only time this intersects with homomorphic encryption is when you're dealing with DRM and other privacy-adverse technologies.
- hacknat 6y ago
  > Binary obfuscation techniques to evade signature detection are a dime a dozen. Fully encrypted programs that can perform and can run on an untrusted platform are not. I think you may have a little more reading to do.
  - some_furry 6y ago
    Fully encrypted programs can do things without the end user having any way of verifying that they're not backdoored or behaving otherwise maliciously. (As a reminder, I'm not saying that FHE is inherently harmful. I take issue with their marketing spin on FHE as the "Crowl Jewel" is all. The motivations for companies to develop FHE are almost always in line with DRM, which is strictly speaking adverse to user freedom.)

Ar-Curunir 6y ago

It would be good to clarify that this article (and quanta in general) is about the theoretical side of cryptography, which often has little overlap with applications of cryptography, especially when you're at the cutting edge of theoretical research like this work is. However, that doesn't mean that iO isn't useful for tasks that you might care about. For example, * deniable encryption (https://eprint.iacr.org/2013/454.pdf https://eprint.iacr.org/2013/454.pdf), * better constructions of post-quantum NIZKs (which can help with ensuring that a remote server is behaving honestly), * proving results about the hardness of finding Nash equilibria (https://ieeexplore.ieee.org/abstract/document/7354468 https://ieeexplore.ieee.org/abstract/document/7354468)