3 ms·
Looking through the list of authors: Florida Atlantic University Amazon IBM Research Microsoft, Microsoft, Microsoft, more Microsoft LinkedIn Lousiana Tec
by lizardactivist 4y ago
Looking through the list of authors:
Florida Atlantic University
Amazon
IBM Research
Microsoft, Microsoft, Microsoft, more Microsoft
LinkedIn
Lousiana Tech University
Texas Instruments
yikes... these are who we already rely on every day to keep our data, our services, and our softwares safe and secure.
- p4bl0 4y agoNot that I have any form of sympathy for these companies, but I think it is safe to assume that regarding cryptography, what's done in research labs and what's put in production at the same time is not at all the same thing, even in the same company.
- FartyMcFarter 4y agoI doubt the researchers who invented this encryption algorithm are security engineers in charge of keeping those companies' software safe. Even if they were the same people, the skill sets of each job are quite different. Being flawed at inventing new algorithms doesn't mean you're flawed at applying state of the art security to existing software.
- elil17 4y agoI would go so far as to say that making an algorithm that doesn't work doesn't make you bad at inventing new algorithms. Trying ideas that might not work is part of science.
- FartyMcFarter 4y agoAgreed - I didn't mean to say the researchers are flawed (negative results are part of the process as you say). I just meant that even if they were that doesn't really matter, in order to zero in on the OP's concern.
- arecurrence 4y agoThe particular attack is very specific and not really relevant to the implication of the last line in this comment. "One unexpected facet of the attack is that it uses genus 2 curves to attack elliptic curves (which are genus 1 curves). A connection between the two types of curves is quite unexpected. To give an example illustrating what I mean, for decades people have been trying to attack regular elliptic curve cryptography, including some who have tried using approaches based on genus 2 curves. None of these attempts has succeeded. So for this attempt to succeed in the realm of isogenies is an unexpected development."
- plopilop 4y agoI don't get your point. Cryptography (especially new protocols such as SIKE or anything PQ) must undergo public scrutiny for years or decades, and sometimes get destroyed in the process, that's how it works. Coming up with a usable public key scheme not trivially insecure is already incredibly difficult. Also, while the attack here is devastating there is no blame to put on SIKE authors: the field is immensely vast, complex and abstract, no one can know everything. The attack relies on a somewhat recent result that is definitely not classical crypto textbook. Furthermore the cryptosystems used by these companies are the ones that have been tested and standardized through the years, not the brand new algorithm designed by cryptographers (as new algorithms must be scrutinized first). Also, as another commenter suggests cryptographers are not the ones in charge of the actual implementation at their companies. Finally, you are making a big confusion between cryptography and security.
- qorrect 4y ago> Lousiana Tech University I think you found the offender.