5 ms·
Brief-ish TLDR (note: I am summarizing what Daniel Bernstein says in the linked article, and make no comment on its correctness; this is relevant because Bernst
by gjm11 5y ago
Brief-ish TLDR (note: I am summarizing what Daniel Bernstein says in the linked article, and make no comment on its correctness; this is relevant because Bernstein makes some accusations about another academic) --
Back in 2016, Google began an experiment with "post-quantum cryptography", deploying some cryptographic algorithms in Chrome and in Google's servers that should be resistant to attack by quantum computers. (Most present-day crypto would be very badly broken if non-toy quantum computing becomes practical.)
But they shut it down after a few months, even though it seemed to be working well. They'd originally said that if it went well they'd find a better algorithm and switch to it in a couple of years. So what happened?
Plausible answer: shortly after beginning this experiment they were contacted by a cryptography researcher (Jintai Ding) who holds a patent that allegedly covers the algorithm they were using. The easiest course of action when this happens is just to shut the thing down.
So how come they didn't know about this patent?
Plausible answer: because another cryptography researcher (Chris Peikert) deliberately and systematically misled the academic community in order to avoid them noticing Ding's work -- because Ding did an important thing in 2012, and Peikert did essentially the same thing in 2014, and Peikert wanted to take credit for inventing it. Peikert succeeded, everyone thinks he invented the relevant things first, and no one thought to check whether Ding might have patents on it.
(I reiterate that I am summarizing Bernstein's claims, and I do not know whether they are right or not.)
TLDR of the TLDR: according to Bernstein, a dishonest academic cryptographer went out of his way to deceive his colleagues into ignoring earlier work by another cryptographer, so as to get the credit for it himself, this led to an important patent being overlooked by Google, and this has been a completely unnecessary stumbling block in the way of getting post-quantum cryptography deployed, so that Peikert's (alleged) selfishness and dishonesty have made everyone's data much less safe against future quantum-computer-based attacks.
- Ar-Curunir 5y agoI will note that DJB has a long-running beef with Chris Peikert, and seems generally opposed to lattice-based PQC. From my impression (as another academic cryptographer), Chris seems to be a genuine person, and not one to "deceive his colleagues"; he is also generally well-liked in the community. DJB, on the other hand, is known for being highly opinionated, and is a bit of an iconoclast in the cryptography community.
- deleted 5y ago[deleted]
- gjm11 5y agoIf the straightforwardly checkable claims in what DJB wrote are correct (which I have not checked) then I have trouble seeing how Peikert could be blameless, though he could certainly be less consciously and deliberately deceptive than DJB is representing him as. E.g., I think the following scenario is consistent with all DJB's straightforwardly checkable claims: Peikert did see Ding's 2012 paper, or at least its 2014 revision, but didn't read it carefully and didn't appreciate that it meant Ding had anticipated Peikert's innovations by 2 years; Peikert's subsequent writing on the subject is misleading but not intended to deceive. And, of course, if DJB is wrong on some of the straightforwardly checkable claims, all bets are off. DJB is opinionated and iconoclastic, for sure, but I wouldn't generally expect him to make claims that are flatly false. E.g., if he says that Ding (2012) does basically all the important things that Peikert (2014) does then I would expect that to be correct. But I don't know the Bernstein/Peikert history, and even generally reliable people can go badly wrong when it comes to people they really hate...
- kragen 5y agoBernstein is generally careful to make only claims that he knows to be correct. Presumably Peikert will see this post and will either not respond publicly, or respond. If he responds publicly he will either deny or affirm Bernstein's claims. If he does not respond, he is being consciously and deliberately deceptive. If he affirms Bernstein's claims, he was being consciously and deliberately deceptive in the past. If he denies Bernstein's claims, then either they are correct or not. If they are correct, then his denial is just more of the kind of deception Bernstein caught him at. If they are incorrect, then Bernstein is the one at fault.
- Ar-Curunir 5y agoDJB regularly makes false claims on the relevant pqc mailing list; it has at various points devolved to him making false claims about lattice-crypto security, and various cryptographers correcting him.