4 ms·

I mean, the same argument has been applied to other cryptographic tools. Why encrypt your messages, unless you're sending something sketchy? Why obfuscate progr

I mean, the same argument has been applied to other cryptographic tools. Why encrypt your messages, unless you're sending something sketchy? Why obfuscate programs, unless you're hiding something? Yet I think the utility of encryption is well-demonstrated, and not just theoretical. It can be used by good people to defend against adversarial intent. And it may well be that obfuscation (in its most direct application) has the same effect. (e.g. companies sharing proprietary algorithms for you to run at home, without revealing the secret sauce; or me delegating computation to AWS without revealing secrets) Note that this is not why indistinguishability obfuscation (iO) is a crown jewel, here. Practically, iO is nowhere close to obfuscating anything larger than a tiny circuit. But it can still be useful to do things like obfuscate secret keys when designing cryptographic protocols. Theoretically, iO allows us to derive essentially every cryptographic primitive, which is why this paper is interesting, and why iO is called a crown jewel. And now, we can build iO for the first time from well-studied hardness assumptions.

yjftsjthsd-h 3y ago
> I mean, the same argument has been applied to other cryptographic tools. Why encrypt your messages, unless you're sending something sketchy? Why obfuscate programs, unless you're hiding something? It's easy to argue that everyone has legitimate interest in hiding some things in data, but what would be a legitimate case for hiding things in code?
- Brotkrumen 3y ago
  "This is a trade secret. We have not patented it, because it's so clever and valuable that it needs to be protected longer than a patent lasts"
  - Xelynega 3y ago
    Except we know(and have example from cryptocurrency) that the problems with ownership in real life have little to do with cryptography. The reason coca cola doesn't use Pepsi's recipe isnt because mixing the ingredients under heat creates an irreversible mixture that you can seperate to find the recipe. They don't use pepsis recipe because its illegal.
    - Attrecomet 3y ago
      That's true for a recipe that was developed in a past millennium. Trade secrets are still very much relevant for companies that work with more modern technologies than soda from before the Great War, and a useful protection against competition. Even if you do believe that companies within the US or EU wouldn't touch other's IP with a 10 foot pole due to strong laws, you'd have to be very naive to think this is valid in all parts of the globe. Edit: it's also trivially not true for trade secrets in the legal sense -- if you upload your trade secret willingly to AWS, it's no longer a trade secret, unless you have extra contracts in place. With obfuscation, you could skip a lot of red tape to keep it secret.
    - liminvorous 3y ago
      You can't copyright a recipe, the thing reason it doesn't make sense for Pepsi to make an exact duplicate of coke is that Coke is better at selling Coke that Pepsi is, and it's better for them to be a niche alternative some people prefer than to be an undifferentiated competititor. Reverse engineering trade secrets is perfectly legal if you haven't agreed otherwise.
      - andrewflnr 3y ago
        Since when is coca cola niche?
  - pxc 3y ago
    That remains a fundamentally anti-social motivation...
- joelfried 3y ago
  Making it harder for bad actors to create malware would seem like one legitimate case.
moring 3y ago
> I mean, the same argument has been applied to other cryptographic tools. Why encrypt your messages, unless you're sending something sketchy? Why obfuscate programs, unless you're hiding something? There is a huge difference: Encryption is used to hide something from a third party, while obfuscation is used to hide something from the intended recipient. Or, if you'd like to argue that the intended recipient is the computer, not the user: To turn that computer into a deputy of the sender, while still formally belonging to the recipient.
- consp 3y ago
  > while obfuscation is used to hide something from the intended recipient. No. Most obfuscation is done to increase the time needed to reverse the source of publicly available programs. Not the user (99% of the recipients) but the adversary is the intended target. The users are just cought in the crossfire. Unless you consider every user of apps as someone who has both the skill and the need to reverse engineer your app.
  - Xelynega 3y ago
    > No. Most obfuscation is done to increase the time needed to reverse the source of publicly available programs. So to stop the intended recipient from deciphering the program. "Adversaries" are the strawman used to hurt legitimate customers who are left with black boxes for device drivers and no functioning hardware since the manufacturers make it impossible to open source firmware updates.
    - ilyt 3y ago
      In case of DRM sure, but there are cases like online games where "adversaries" are players (intended users of the app) trying to use cheat programs on game binary to get an advantage over other players. I share the sentiment that in most cases it just serves DRM vendors and is disservice to users but that's not all the cases.
denton-scratch 3y ago
> and why iO is called a crown jewel. Ah, thanks. That's far from clear in the article.
ilyt 3y ago
> I mean, the same argument has been applied to other cryptographic tools. Intent matters. > Why encrypt your messages, unless you're sending something sketchy? Because I am sending something private, I can't believe people bring this dumbass argument still, and even here. > Why obfuscate programs, unless you're hiding something? Why indeed. This one is the red flag, not message in your e-mail client being encrypted. Again. Intent, and context, matters.
- Vervious 3y ago
  You say the intent is different but don’t show why. What about obfuscation implies malicious intent? How come it doesn’t apply to encryption? It can’t be about applications, because I can come up with a thousand applications for obfuscation with benign intent. Such as delegating private computation to AWS without Amazon learning my personal information.

yjftsjthsd-h 3y ago

> I mean, the same argument has been applied to other cryptographic tools. Why encrypt your messages, unless you're sending something sketchy? Why obfuscate programs, unless you're hiding something? It's easy to argue that everyone has legitimate interest in hiding some things in data, but what would be a legitimate case for hiding things in code?

Brotkrumen 3y ago
"This is a trade secret. We have not patented it, because it's so clever and valuable that it needs to be protected longer than a patent lasts"
- Xelynega 3y ago
  Except we know(and have example from cryptocurrency) that the problems with ownership in real life have little to do with cryptography. The reason coca cola doesn't use Pepsi's recipe isnt because mixing the ingredients under heat creates an irreversible mixture that you can seperate to find the recipe. They don't use pepsis recipe because its illegal.
  - Attrecomet 3y ago
    That's true for a recipe that was developed in a past millennium. Trade secrets are still very much relevant for companies that work with more modern technologies than soda from before the Great War, and a useful protection against competition. Even if you do believe that companies within the US or EU wouldn't touch other's IP with a 10 foot pole due to strong laws, you'd have to be very naive to think this is valid in all parts of the globe. Edit: it's also trivially not true for trade secrets in the legal sense -- if you upload your trade secret willingly to AWS, it's no longer a trade secret, unless you have extra contracts in place. With obfuscation, you could skip a lot of red tape to keep it secret.
  - liminvorous 3y ago
    You can't copyright a recipe, the thing reason it doesn't make sense for Pepsi to make an exact duplicate of coke is that Coke is better at selling Coke that Pepsi is, and it's better for them to be a niche alternative some people prefer than to be an undifferentiated competititor. Reverse engineering trade secrets is perfectly legal if you haven't agreed otherwise.
    - andrewflnr 3y ago
      Since when is coca cola niche?
- pxc 3y ago
  That remains a fundamentally anti-social motivation...
joelfried 3y ago
Making it harder for bad actors to create malware would seem like one legitimate case.

moring 3y ago

> I mean, the same argument has been applied to other cryptographic tools. Why encrypt your messages, unless you're sending something sketchy? Why obfuscate programs, unless you're hiding something? There is a huge difference: Encryption is used to hide something from a third party, while obfuscation is used to hide something from the intended recipient. Or, if you'd like to argue that the intended recipient is the computer, not the user: To turn that computer into a deputy of the sender, while still formally belonging to the recipient.

consp 3y ago
> while obfuscation is used to hide something from the intended recipient. No. Most obfuscation is done to increase the time needed to reverse the source of publicly available programs. Not the user (99% of the recipients) but the adversary is the intended target. The users are just cought in the crossfire. Unless you consider every user of apps as someone who has both the skill and the need to reverse engineer your app.
- Xelynega 3y ago
  > No. Most obfuscation is done to increase the time needed to reverse the source of publicly available programs. So to stop the intended recipient from deciphering the program. "Adversaries" are the strawman used to hurt legitimate customers who are left with black boxes for device drivers and no functioning hardware since the manufacturers make it impossible to open source firmware updates.
  - ilyt 3y ago
    In case of DRM sure, but there are cases like online games where "adversaries" are players (intended users of the app) trying to use cheat programs on game binary to get an advantage over other players. I share the sentiment that in most cases it just serves DRM vendors and is disservice to users but that's not all the cases.

denton-scratch 3y ago

> and why iO is called a crown jewel. Ah, thanks. That's far from clear in the article.

ilyt 3y ago

> I mean, the same argument has been applied to other cryptographic tools. Intent matters. > Why encrypt your messages, unless you're sending something sketchy? Because I am sending something private, I can't believe people bring this dumbass argument still, and even here. > Why obfuscate programs, unless you're hiding something? Why indeed. This one is the red flag, not message in your e-mail client being encrypted. Again. Intent, and context, matters.

Vervious 3y ago
You say the intent is different but don’t show why. What about obfuscation implies malicious intent? How come it doesn’t apply to encryption? It can’t be about applications, because I can come up with a thousand applications for obfuscation with benign intent. Such as delegating private computation to AWS without Amazon learning my personal information.