Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Unbreakable" Encryption Almost Certainly Isn't

schneier.com

Post reply on HN
Print view View original

41–50 of 62 posts

Re: "Unbreakable" Encryption Almost Certainly Isn't

#41

Post by hueving »

andrewla wrote: post #36
dllthomas wrote: post #21

Earlier quoted context omitted.

That was not the assumption. The assumption (or assertion) was that one-time pads were the only unbreakable encryption . There are ways of securing things other than encryption (most obviously physical isolation).

Ach! I let myself get drawn into a semantic argument, and it earned me my first downvotes! My only point was that talking about one-time-pads as "unbreakable" encryption is not a useful discussion, since "unbreakable" and "encryption" need to be better defined. If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close…

>My only point was that talking about one-time-pads as "unbreakable" encryption is not a useful discussion, since "unbreakable" and "encryption" need to be better defined.

No they don't. You are receiving negative feedback because you are trying to adjust definitions that have been well-defined by the crypto community. When talking about the security of an encryption algorithm, the key distribution has absolutely nothing to do with it. Stop conflating the two.

>If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close to the only unbreakable system.

Would you care to share with us some of these other unbreakable systems? Remember, the keys are the only thing that can be transmitted outside of the channel and they cannot be based on the information being encrypted.

Re: "Unbreakable" Encryption Almost Certainly Isn't

#42

Post by pnathan »

It's always kind of cute to see ridiculous headlines roll through.

Taking a look at the paper and a stream of thought about it.

- Researchers are affiliated with a university they aren't kooks

- These are physicists. They speak a different language. That will make decoding this paper difficult. It may have useful insight, but it is obscured by the jargon of a different discipline. Typically I haven't see continuous diffeq in crypto. >.>

- Essentially I believe this is a two-directional stream cipher, with prior clear?crypt?text from both sides feeding into the input.

- I'm not sure what unbounded precisely is being meant here with their coupling function.

- Almost zero crypto papers cited (I counted two, and they sounded fringe-y by title and were also published in physics journals).

Several key aspects have been neglected by the authors:

- Lack of citation of the current state of crypto- they betray nearly no understanding of the terminology of crypto nor present the contribution to the field in relation to the field.

- No analysis of the information-theoretic leakage of the communication system.

- No analysis of keyspaces, expected break time for chosen|known ciphertext, etc.

My take on it is that it's a well-intentioned but largely useless paper by non-experts. If they took the time to understand the field, it might have some valuable insights.

I would guess the coupling function as an idea results in a system design that leaks information like a sieve about both Alice and Bob. It might be a restatement of something like switching keys periodically, but I lack the vocab to interpret.

Re: "Unbreakable" Encryption Almost Certainly Isn't

#43

Post by hueving »

infruset wrote: post #29

In the referenced article ( https://www.schneier.com/crypto-gram-9810.html#cipherdesign ), he says: > Algorithms posted to Internet newsgroups by unknowns won't get a second glance. It seems to me this would not be true of Bitcoin.

Bitcoin isn't a new crypto algorithm. It's a distributed ledger algorithm that uses well known crypto protocols. It didn't invent its own magical hashing algorithm or anything of the sort.

Re: "Unbreakable" Encryption Almost Certainly Isn't

#44

Post by aidenn0 »

mannykannot wrote: post #22
andrewla wrote: post #6

Earlier quoted context omitted.

While this may seem like a tempting statement, it is not really an answer, since "unbreakable" is not really well-defined. Clearly, "truly random" is a bit of a tough one to define. And sending the message length is a bit of an information leak itself. But even putting those aside, there's a bigger flaw. The biggest problem in this mechanism is how does the other party get their one-time pad? An upper bound on the un…

You do not actually have to define "truly random". You do have to trust that the mechanism you are using to generate keys (radioactive decay or rolling dice, for example) is unpredictable. There is a more general point here, that sometimes seems to be lost in philosophical arguments: reality doesn't pay any attention to the meaning of words. If "unbreakable" is not well-defined (I am not sure that is so), then it is…

Unpredictable and unbiased

Re: "Unbreakable" Encryption Almost Certainly Isn't

#45

Post by _kst_ »

voidlogic wrote: post #35
andrewla wrote: post #19

Earlier quoted context omitted.

I mean, what you're saying here is that in addition to one-time-pad based cryptography, there is a "give a briefcase to the person"-based cryptographic system. In reality, I think lot more briefcase-based transfers are "cracked", as it were, than SSL sessions. My problem is just that the proposed mechanism relies on already having an even more perfect mechanism, and thus cannot be the "only one", but is in fact stric…

No, this is a a breifcase full of one time pad. If you could fit 32 4 TB hard drives full of pad in the brief case that would allow you to send 128 TB in the future securely using something like an XOR one time pad. Assuming you are just sending ASCII and compress it before sending/XORing you could send a lot more then 128 TB of ASCII. This is pretty powerful. It means that organization which and periodically move ph…

Was "128 GB" a typo for "128 TB"?

Incidentally, the mechanism for sharing the pad doesn't have to be 100% secure, as long as you can reliably detect any compromises. If someone opens the briefcase while it's in transit, you just generate new pads and send another briefcase. To compromise the system, an adversary has to compromise the pad in transit without being detected.

Re: "Unbreakable" Encryption Almost Certainly Isn't

#46

Post by omh »

voidlogic wrote: post #38
omh wrote: post #30

Earlier quoted context omitted.

If I was using one-time-pads I'd probably be using them because I didn't trust encryption, so "unencrypted" wouldn't matter here. In real-world implementations I think the security is probably based around a large number of men with guns.

Exactly, men with guns secure the one time pad. The data sent using that pad is secure. Nit: I would consider one time pad to be a method of encryption.

Nit: I would consider one time pad to be a method of encryption.

Ah, true. But the encryption algorithm is much simpler to implement than most :-)

Re: "Unbreakable" Encryption Almost Certainly Isn't

#47

Post by darkmighty »

andrewla wrote: post #36
dllthomas wrote: post #21

Earlier quoted context omitted.

That was not the assumption. The assumption (or assertion) was that one-time pads were the only unbreakable encryption . There are ways of securing things other than encryption (most obviously physical isolation).

Ach! I let myself get drawn into a semantic argument, and it earned me my first downvotes! My only point was that talking about one-time-pads as "unbreakable" encryption is not a useful discussion, since "unbreakable" and "encryption" need to be better defined. If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close…

"If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close to the only unbreakable system."

Any scheme which allows sharing arbitrary amounts of random information is less than or equally secure as an OTP (security defined per symbol) since OTP reveals no information per symbol; also, it uses the minimum amount shared information to do so, provided your symbols are equiprobable.

Re: "Unbreakable" Encryption Almost Certainly Isn't

#48

Post by samatman »

LukeWalsh wrote: post #4

There's only one "unbreakable" encryption, and that's a pair of one time pads with truly random data as long as the message itself. http://www.pro-technix.com/information/crypto/pages/vernam_b...

This singular, provable fact is the basis of the modern Internet.

...we're not on the modern Internet. I'm looking forward to it; it'll be a better place.

Re: "Unbreakable" Encryption Almost Certainly Isn't

#49

Post by mpyne »

LukeWalsh wrote: post #4

There's only one "unbreakable" encryption, and that's a pair of one time pads with truly random data as long as the message itself. http://www.pro-technix.com/information/crypto/pages/vernam_b...

This was actually broken in practice once, by (you guessed it) NSA. They managed to break into part of Soviet VENONA since the demand of OTP keymat during WWII was such that someone took a shortcut and reprinted pages of random numbers.

Don't ask me how Cold War-era NSA discovered that without Cray supercomputers everywhere, but even this scheme is difficult to pull off in practice.

Re: "Unbreakable" Encryption Almost Certainly Isn't

#50

Post by kevincrane »

Xylakant wrote: post #7
LukeWalsh wrote: post #4

There's only one "unbreakable" encryption, and that's a pair of one time pads with truly random data as long as the message itself. http://www.pro-technix.com/information/crypto/pages/vernam_b...

And even this is in practice a problem: How do you distribute and secure the pads? A lot of problems in cryptosystems stem from implementation details - think side-channel attacks, exploits, ...

Well that's exactly the reason the one-time pad isn't used anywhere. It's perfectly secure but basically impossible to actually implement securely because of key distribution.
Post reply on HN