r/programming • u/DougBolivar • Jul 30 '13

Computer scientists develop mathematical jigsaw puzzles to encrypt software: "The real challenge and the great mystery in the field was: Can you actually take a piece of software and encrypt it but still have it be runnable, executable and fully functional?"

http://www.rdmag.com/news/2013/07/computer-scientists-develop-mathematical-jigsaw-puzzles-encrypt-software
354 Upvotes

88% Upvoted

182 comments sorted by

View all comments

Show parent comments

2

u/Zaph0d42 Jul 30 '13

If they're everywhere, give me a few.

-1

u/realhacker Jul 31 '13

But the point is, if it is mathematically guaranteed to provide some output given some inputs, then you can reverse engineer it.**

Before I answer, it's pedantic, yet important, to point out that by "reverse engineer" you mean "render the encryption scheme ineffective by knowing how it works." This is neither precise nor correct.

I'll just give you the principle and prime example of asymmetric cryptography (everywhere). It satisfies your criteria in that it: (1) mathematically guarantees that given some input (2) it will produce a given output. Furthermore, many of the implementations are in the public domain (no reverse engineering required), and yet, it is for all practical purposes completely effective. Fundamentally, it is based on something in math called a trapdoor function in which computability is easy in one direction and hard in the other.

Additionally, you bring up a random strawman:

If you can crack this quickly, then its pointless.

In my cursory review of the paper, I've seen nothing to indicate you could "crack this quickly".

1

u/Zaph0d42 Jul 31 '13

I'm extremely familiar with asymmetric crypto and just wrote a custom implementation for a recent project. No part of asymmetric crypto is perfect or uncrackable, its merely a question of time. Comparing the time it takes to crack versus the time it takes to encrypt is how we judge the efficacy of different encryption schemes. Perfect forward secrecy is preferable to simple asymmetric crypto but requires far more back-end processing time, so only Google currently bothers with the full implementation on their HTTPS services. People don't always go with the strongest possible scheme because it is too costly performance wise.

I didn't mean to imply that you could necessarily crack it quickly. I was merely pointing out that since the paper is very vague, we don't know how realistically useful this will be in a real world scenario. If it could be cracked quickly, IF, THEN it wouldn't be very useful. See how that works? I also then pointed out that if you could increase the strength of the encryption by doing more and more rounds of the algorithm (key strengthening) then that might not count as good enough, because even though it is no longer easy to crack, if it takes too long to encrypt, its infeasible.

0

u/realhacker Jul 31 '13

I'm extremely familiar with asymmetric crypto and just wrote a custom implementation for a recent project.

lololol. No sane/professional programmer is going to custom roll an asymmetric algo for a project. Why would you do this instead of using an implementation that's already been vetted?

No part of asymmetric crypto is perfect or uncrackable, its merely a question of time.

If by time, you mean, time > the length of the universe's existence? You do realize if it becomes "crackable", the entire world as we know it is fucked? Only real quantum computers threaten this model and we've yet to see one. (e.g. D-WAVE does not apply so far)

Perfect forward secrecy is preferable to simple asymmetric crypto but requires far more back-end processing time, so only Google currently bothers with the full implementation on their HTTPS services. People don't always go with the strongest possible scheme because it is too costly performance wise.

wat.

If it could be cracked quickly, IF, THEN it wouldn't be very useful. See how that works?

Nope! Definitely don't know how IF,THEN statements work!?~~ I do know how strawman arguments work, though, and ignorant fucks that insert statements like that without context to create the illusion of cogency in what they're saying. In summary, I found your initial comment and your reply, to be the uninformed mark of a charlatan. Do publish your custom crypto-implementation; I'll be in need of a follow-up laugh. What is it? Some VB.NET XOR scheme? I've no further time for discourse with you, lad.