At the penultimate opening keynote at the encryption technology conference named after the company and technology he co-founded, Ronald Rivest admitted that his cryptography panel had something of a name problem.

Rivest, who together with his co-panelist Adi Shamir helped establish the RSA system and a standard for public-key encryption, wanted to remind attendees, that “crypto is for cryptographers, and there should be something else for the cryptocurrency people.”

In recent years there hasn’t been. Haphazard media shorthand propelled blockchain-based digital assets such as Bitcoin into the mainstream of public consciousness as “crypto” instead of currency. That shorthand meant every discussion of how to communicate securely without being eavesdropped ion also had to first wrestle with how to distinguish the code that keeps modern communications private from the speculative mining and reselling of digitally generated objects.

It also meant that the panel, which besides Rivest and Shamir included pioneering cryptographer Whitfield Diffie, security researcher Paul Kocher, Signal founder Moxie Marlinspike, and RSA CTO Zulfikar Ramzan, had to start their conference debating the merits of blockchain as a tool for keeping secrets.

“Blockchain is essentially an inefficient database,” said Rivest. He noted that he didn’t see a lot of merit in using blockchain for elections or voting, processes that require a centralized database to produce a verifiable public result.

The panel’s discussion of blockchain in microcosm reflected a broader theme for all of the cryptographers present: can much-hyped technologies provide answers to long-standing cryptographic problems? The panel’s answer, in so much as there was one, was a resounding ‘maybe, but let’s wait and see.’

“Whenever you have to keep a secret, you have a vulnerability,” responded Whitfield Diffie, in reference to the relatively self-contained nature of cryptocurrency interactions. “Anything that doesn’t rely on secrets has some merit.”

Asked about the development of new cryptographic best practices for the National Institute of Standards and Technology, Shamir noted it took well over a decade to adopt RSA. With that as a baseline, Shamir discussed several new cryptographic proposals for NIST, and suggested that hash-based security is the most likely to be accepted since they’ve been proven for so long.

““I think we’ll see quantum supremacy soon but we’re still a long way from quantum cracking of cryptography,” said Paul Kocher, referring both to the benchmark standard for when quantum computers can outpace traditional computers in processing power, and also the threat that those powerful computers will pose to the traditional means of encryption. Quantum computing is buzzy, and research into it is well-funded, but it’s as likely to solve old problems as it is to create new ones.

The manner in which new problems are disclosed also earned some stage time. Kocher, who co-discovered the Spectre hardware vulnerability, noted that while software flaws can be revealed to companies first so they can write a patch in time for public disclosure, with hardware there simply isn’t a way to after-the-fact patch it all, and especially not in a way that retains functionality while improving security. The answer to that challenge may be beyond the reach of cryptographers themselves.

“Having failed on this twice,” said Kocher, “I think we need some ethicists on this.”

Ramzan asked the panel to close by suggesting some silver linings in the field of cryptography.

Marlinspike, whose grim analysis maybe best captured the moment of the present, had the far-reaching optimistic take, a holistic vision of the goal of cryptography: “privacy and crypto tech are less like protecting private shards, and more about building world we want.”

Rivest and Kocher both looked to available means of threat reduction. Kocher noted that better cryptography can reduce the attack surface, the ways for adversaries to get into and disrupt systems. Rivest pointed out that, instead of looking to something new, security researchers can recommend old tools for building in redundancy to systems that might get attacked. For election security, he said, that means paper ballots, not blockchain.

Shamir and Diffie summarized the somewhat more fatalistic perspective.

“A silver lining?” said Shamir, “Job security for cybersecurity professionals is guaranteed.”

“Cyber isn’t solved,” said Diffie. “We still have work to do.”

The overflow room laughed, nervously. In a couple hours, the gathered attendees would be wandering the convention, watching new technology demonstrations or shopping the exhibitor floorshow, looking for the magic tool to fix every problem in keeping information secure. Maybe some of those tools would even use blockchain.

About Kelsey D. Atherton

Kelsey Atherton blogs about military technology for C4ISRNET, Fifth Domain, Defense News, and Military Times. He previously wrote for Popular Science, and also created, solicited, and edited content for a group blog on political science fiction and international security.

Share:
More In Cyber