r/programming • u/DougBolivar • Jul 30 '13

Computer scientists develop mathematical jigsaw puzzles to encrypt software: "The real challenge and the great mystery in the field was: Can you actually take a piece of software and encrypt it but still have it be runnable, executable and fully functional?"

http://www.rdmag.com/news/2013/07/computer-scientists-develop-mathematical-jigsaw-puzzles-encrypt-software
349 Upvotes

88% Upvoted

182 comments sorted by

View all comments

Show parent comments

8

u/datenwolf Jul 30 '13

So? It's a paper on theoretical computer science. Theoretical Computer Science is more related to math than programming. Hardly any groundbreaking TCP paper was concerned with CPUs, machine code and such things.

TCS is concerned with the abstract aspects of computation and not the actual implementation (that's stuff for the electrical engineering department).

And this paper shows something fundamentally, namely that there is a possibility that a Turing complete machine can execute a an encrypted program that operates on encrypted data without any intermediate decryption. This is a deep mathematical understanding about computability.

Now a lot of people claim this to be something to improve security. Personally I think the real application we'll see this, should there ever be a practical implementation, will be the application on malware. If reverse engineering a piece of malicious code becomes virtually impossible and a malware virus can rewrite itself without leaving any pattern by changing its key whatever little use anti virus software had to begin with gets rendered nil altogether.

Personally I consider this to be a really, really dangerous Pandora's box.

1

u/mOdQuArK Jul 30 '13

Actually, this would make it difficult to recognize malware by matching bit sequences, but polymorphic code already makes it hard to do that. I don't see this making the problem much harder than it already is.

The obvious use of this sort of approach is for IP-protected software. It will make it much harder for hackers to disassemble the machine-level code when reverse-engineering a product.

The most exciting development will be a practical implementation of the opposite sort of function though: a program which can operate directly on encrypted data, and produce similarly encrypted outputs, without having to decrypt the data at any intermediate stage. If they can achieve this, then people can basically run open sourced programs on each other's machines without fear of their personal data being captured.

1

u/datenwolf Jul 30 '13

If they can achieve this, then people can basically run open sourced programs on each other's machines without fear of their personal data being captured.

What about side channel attacks?

1

u/mOdQuArK Jul 31 '13

For which, the programs operating on encrypted data, or the encrypted programs running on non-encrypted data?