11–20 of 26 posts
Out of curiosity: If you were to design Tarsnap from scratch in 2013, would you still use RSA?
I think so.
Earlier quoted context omitted.
I think so.
Am I right to guess its because you're more worried about what people get wrong about ECC imementations in 2013, perhaps that we don't even really know about in 2013, than about anything fundamental about ECC or RSA?
For someone who is somewhat unfamiliar with cryptography, what is the obstacle in creating cryptography that is provably secure: in other words, cryptography that can be absolutely trusted within certain provided parameters.
Heuristically speaking, this problem is at least as hard as the P != NP question, which is one of the millenium problems for which the Clay institute has awarded one million dollars to whoever resolves it. From a theory point of view, breaking a crypto-system typically means something like being able to do the following fast (i.e., in polynomial time): Given two plaintexts and a ciphertext which is the encryption of…
I think Colin's bang on here. Now is the time for cryptographers and software developers to act to implement a mature alternative to RSA, but it's not the point for your average joe to switch to an as yet relatively untested/unproven ECC implementation. For what it's worth, Tom Ritter recently posted his notes on de-anonymizing alt.anonymous.messages[1], something widely believed to be very anonymous and very secure.…
How is EC “relatively untested/unproven”? It's been in OpenSSL for ages (by internet norms), is the subject of numerous national standards. It secures a billion dollar bitcoin economy.
For someone who is somewhat unfamiliar with cryptography, what is the obstacle in creating cryptography that is provably secure: in other words, cryptography that can be absolutely trusted within certain provided parameters.
Earlier quoted context omitted.
Heuristically speaking, this problem is at least as hard as the P != NP question, which is one of the millenium problems for which the Clay institute has awarded one million dollars to whoever resolves it. From a theory point of view, breaking a crypto-system typically means something like being able to do the following fast (i.e., in polynomial time): Given two plaintexts and a ciphertext which is the encryption of…
I think the complexity class of discrete log or integer factorization are not known. No one has proved there isn't a polynomial time algorithm but if one is found it does not mean P = NP.
Intuitively, NP-hard problems are believed to be harder than factorization and discrete log. And so it should be easier to prove that an NP-hard problem is not in P.
What you are referring to is the opposite direction of the implication, which is very relevant in a discussion of why people have failed to find faster algorithms for integer factorization. However, the question I replied to is essentially why people have failed to prove that integer factorization (and discrete log) are hard problems.
Edit: After re-reading my previous comment, perhaps this clarifies it best: Integer factorization and discrete log are probably less hard than NP-hard problems. However, the meta-problem "prove that integer factorization or discrete log is really, unconditionally hard" is at least as difficult as the meta-problem "prove P != NP".
For someone who is somewhat unfamiliar with cryptography, what is the obstacle in creating cryptography that is provably secure: in other words, cryptography that can be absolutely trusted within certain provided parameters.
There is one public key system that is pretty much that, it's called Merkle Puzzles. It's kind of non-practical though. No one has found a system that is practical and provably secure. You need the right kind of problem. Pretty much all the problems we have today that can be used for public key cryptography are thought to be hard but can't be proved to be hard. Under the assumption they are hard the system is proved…
You might wonder if something closer to Merkle's approach could be improved to produce a larger gap, but the answer turns out to be no: http://www.boazbarak.org/Papers/merkle.pdf
For someone who is somewhat unfamiliar with cryptography, what is the obstacle in creating cryptography that is provably secure: in other words, cryptography that can be absolutely trusted within certain provided parameters.