Two years ago, I was raped by a leader in the privacy/security community. The
#CCC
provided a supportive platform for him for years, and his abuse was not a secret. Today, the
#CCC
still fails to protect against other predators.
#34C3
#MeToo
Huge congrats to those that work to make
@torproject
accessible and free to anyone anywhere. Lots of blood, sweat, and tears go into Tor behind the scenes, so happy to see this well-deserved recognition for the team.
New (and first!) blog post on a topic I am starting to do work in- lattices. Lattice cryptography is really interesting! This post is a tiny introduction to several hard problems in lattice crypto. I'll publish a part 2 on lattice-based key exchanges soon.
Really happy to have received news yesterday that myself,
@e1izabethcrites
, and Mary Maller won the Best Early Career Paper Award at Crypto 2023 for our paper “Fully Adaptive Schnorr Threshold Signatures” 💪💃😊
This is why end to end encryption matters. Shame on Facebook for providing private messages between a mother & daughter as incriminating evidence, and misleading their users into thinking their conversations are private.
After 3 years and 12 drafts, the RFC for FROST is finally complete! We hope this makes implementing FROST easier with fewer bugs 🐛
Thank you to everyone who helped by reviewing FROST security, submitting comments, and implementing the draft, this truly was a team effort 🙌💪
It's finally published!
RFC 9591 The Flexible Round-Optimized Schnorr Threshold (FROST) Protocol for Two‑Round Schnorr Signatures
Amazing work by
@chelseakomlo
,
@durumcrustulum
, Ian Goldberg and Christopher Wood.
Happy to have helped it a bit!
The most valuable thing as a cryptographer (to me) is having people who have tried to use your work tell you all of the ways it is hard to use or could be better. That feedback is so critical to trying to design something relevant enough to be considered for real-world use.
I am excited to announce our work “Walking Onions: Scaling Anonymity Networks while Protecting Users”, a set of protocols allowing networks like
@torproject
to scale while requiring only constant bandwidth cost to clients without degrading security
The further into post quantum crypto I go, the more obvious it becomes how completely spoiled we’ve been with Diffie Hellman and how many DH based schemes do.... not map so nicely into PQ variants
One application of threshold cryptography that I would love to see more of in practice is within multi-factor authentication- i.e, if a device is lost, a user can still be logged in and later revoke the lost device, assuming a sufficient number of other available devices.
I’m excited to be joining the
@ZcashFoundation
team! I’ll be working on a part-time basis as I continue with my graduate work at
@UWCrySP
. Thankful for the opportunity to continue contributing to privacy-enhancing technologies used in practice.
Thread: Brave‘s “decentralized VPN” (which to you should read as “routing my traffic through someone’s else’s computer”) unfortunately has fundamental privacy flaws. Let’s take a look at a few.
Proposal: Someone 1) take all the research written on anonymity networks so far, 2) quickly repurpose it for cryptocurrency networks, 3) publish it, to (please dear god) avoid this long tail of painfully relearning every privacy lesson over again but in the context of bitcoin.
A cryptographer's two moods. 1. Look at this idea I had to solve this open problem, absolutely amazing. 2. Wow hahaha look at how broken my idea was, what was I thinking.
Hi normally I tweet about privacy and cryptography, but right now my country is trying to start an unnecessary war, and that is terrifying. I also just read the words implying we might "bumble into war" WTH is going on
#NoWarWithIran
In spite of these extremely difficult times, it’s still important to celebrate the bright spots! Excited to say that Walking Onions, our work on scaling Tor, was accepted to USENIX Security 2020!
Proving the security of Schnorr multi/threshold signatures is notoriously difficult (due to concurrency). We just put out new work on improved techniques to prove security of these schemes, and use these techniques to prove the security of MuSig2 and FROST
It’s up! I am excited to announce an extended abstract of our upcoming work on FROST, a Flexible Round-Optimized Schnorr Threshold signature scheme that enables one-round asynchronous threshold signing. This is joint work with
@ZcashFoundation
and
@UWCrySP
Growth as a cryptographer is not measured simply in the number of clever ideas you have, it is also measured in your ability to break your clever ideas before someone else does!
I’ve called my Republican senator
@SenCoryGardner
multiple times in the past few days to say that Kavanaugh is (obviously) morally unfit for the Supreme Court. Violence against women (or anyone) is unacceptable, anytime, anywhere. Sexual abuse shouldn’t be a partisan issue.
It was such an honor to receive this award and is an inspiration for the future, thank you again!
It has also been a wonderful experience to collaborate with
@e1izabethcrites
and Mary Maller- they are both amazing people as well as talented cryptographers ❤️💪 🙌
I am truly grateful to have received the Best Early Career Paper Award at CRYPTO for “Fully Adaptive Schnorr Threshold Signatures” with
@chelseakomlo
and Mary Maller. Thank you to the Chairs, Britta Hale,
@annalysyanskaya
, and Helena Handschuh and PC for this tremendous honour!!
Thank you to everyone for the kind words. I hope we can make things better for people in the community now and in the future. Thank you to those who are advocating for positive change.
Here I sit, a fool designing cryptography resistant to attacks by quantum computers, while my government proposes just outlawing cryptography as we know it
In this work, we present a fully adaptive proof for a simple three-round threshold Schnorr scheme. We’ll release a similar fully adaptive proof for FROST soon, stay tuned!
I recently gave a talk to a cryptography reading group on the paper "To Label, or Not To Label (in Generic Groups)"- I typed my notes here for anyone interested!
Thanks to
@alinush407
for the inspiration and early review!
Finally getting around to posting part 2 in this series on lattice-based cryptography! This post gives a high-level sketch of an early lattice-based key exchange protocol and a brief review of more recent work since its publication.
New (and first!) blog post on a topic I am starting to do work in- lattices. Lattice cryptography is really interesting! This post is a tiny introduction to several hard problems in lattice crypto. I'll publish a part 2 on lattice-based key exchanges soon.
I wrote a note on end-to-end encryption (E2EE) with Britta Hale, in which we review how intuitive notions of E2EE do or do not map onto existing notions of encryption.
The fallout that will follow the
#tiktokban
will be awful. Other countries will make similar demands of U.S companies, empowering dictatorial governments that seek to make the Internet a walled garden for their citizens. And in the U.S, a normalization of nationalized censorship
The video of
@isislovecruft
and me talking about integrating
@rustlang
into a large C codebase at
@rustconf
is up! Thanks to conference organizers and everyone who helped!
me, thinking of some new cryptography idea involving polynomials: absolutely genius, this will totally work.
me, working through the proof: polynomials were a mistake.
Inspired by
@matthew_d_green
, I tidied up my notes on the forking lemma and several variants thereof! With a tiny discussion of why each variant is useful for tighter security bounds or general applicability to the proof. As a warning, it is very dry :)
I’m supporting
@isislovecruft
and you should too. Just because
@peterktodd
has a lot of Bitcoin money/notoriety doesn’t mean he can shut up people who he has abused.
as many know, i’m being sued by Peter Todd for calling him a rapist. the lawsuit has been stressful and costly, to put it mildly. thanks to so many of you who have graciously offered donations and support—you can find details of how to do so here:
One thing that amazes me is how often really useful cryptography is forgotten about. One of my favorite papers is by Laing/Stinson on (untrusted) recovery/generation of new shares for Shamir-based schemes. These results also apply to threshold signatures!
Had so much fun giving a
@rustconf
talk with the unparalleled
@isislovecruft
on the successes and challenges of using Rust in a large C codebase- also really enjoyed meeting others in the
@rustlang
community! (Our talk will be posted online later)
We published the final version of our work on post-quantum updatable public-key encryption yesterday! Applications include improving forward secrecy for secure messaging protocols in asynchronous group settings (i.e, MLS and Signal)
Thrilled to speak at
@rustconf
with the amazing
@isislovecruft
on integrating
@rustlang
into tor. We look forward to talking about FFI, memory management, and all the ways strings are challenging. Overall, it has been a great journey for Tor and we are excited to talk about it!
super excited to be speaking at
@RustConf
this summer with my friend and
@torproject
colleague
@chelseakomlo
about some of the successes and unexpected challenges we've had integrating
@rustlang
into tor ✨👩🏻💻✨
Studying quantum algorithms, a summary. 1) Grok the double slit experiment and believe that quantum mechanics exists 2) abstract to probabilities over vector spaces, 3) do computer stuff. Go
Recommended series of lattice key-exchange papers (in reading order): Ding et al 2012, Peikert 2014, BCNS 2015, NewHope, 2016. These build on each other and the improvements between each paper is clearly described.
Working my way through why ElGamal is not semantically secure for bilinear groups & linear encryption is needed. Would anyone be interested in a short writeup? It is simple but this knowledge seems implicit in the literature; curious if typing it up would be helpful to anyone
To all FOCS reviewers and PCs. When a paper resolves a long-standing question for one of the most fundamental problems in TCS using simple techniques, and you argue that the paper should be rejected because the technique is simple, you are taking the field backward.
In light of how important anonymity is to user privacy, I review some security requirements necessary to use mixnets in practice; including the needs inherent to large-scale distributed networks, open-source software projects, and end-user products.
Being a cryptography researcher can be rough, producing work with real-world impact can result in what feels like death by a thousand cuts. But thankful today for colleagues that are committed to doing the right thing. And I will share more about CRYPTO acceptances next week!
To summarize our work on proving the security of Schnorr threshold schemes, I wrote a guest blog post describing the security model for FROST and two three-round schemes, and explain why these schemes diverge
On my way to Santa Barbara for my first ever in-person CRYPTO! Hope everyone sticks around for the threshold signatures session on Thursday August 18 at 1pm PST (dead last but hopefully not the least!)
In light of the Apple discussion, can we start a thread about human rights groups that have been categorized as national security threats in the past? So that the consequences of even the smallest increase in scope in client-side matching (to violent extremism) is crystal clear?
Our
@RealWorldCrypto
talk "From Theory to Practice to Theory: Lessons Learned in Multi-Party Schnorr Signatures" is up! Thanks to everyone for a fantastic conference and great conversations.
Acceptance to conferences is nice but the best part is knowing that people are rooting you on and excited about your work. Thanks to everyone for the encouragement, it makes all the difference :)
I wrote Part 2 on lattice-based cryptography, this time focusing on an early but simple lattice-based key exchange protocol that is “Diffie-Hellman like” and how more recent lattice protocols submitted to the NIST PQ competition build upon this work.
To anyone working on real-world cryptography- what would you like to see more of in cryptography research for 2024?
Readable papers? Performance measurements? Accounting for specific failure cases? More PQ? Acceptance of non-standard assumptions? Solving certain problems?
It is a dismal sign when an org revolves around an individual member so much that they bring them back even after acknowledging their abuse. The FSF is clearly unwilling to evolve to new leadership/perspectives. There are *so* many other (more) qualified candidates for this spot
We just published a version 5 of the FROST spec! This change introduces better derivation of randomness for nonces and other improvements. We hope to be getting close to completion, so please take a look!
Also apparently Todd thinks getting declarations against Isis from previously-known rapists like Jacob Appelbaum is a winning move. This is gross and it’s hard to watch
@isislovecruft
be dragged through this. Please support them.
I’m supporting
@isislovecruft
and you should too. Just because
@peterktodd
has a lot of Bitcoin money/notoriety doesn’t mean he can shut up people who he has abused.
Excellent reminder that cryptography doesn’t by itself solve human problems; it just shifts trust. You can’t avoid the hard problem of choosing *where* to place that trust, even if fancy cryptography is used
What we should not do is assume that *because we’ve improved the cryptography* we’ve solved the hard problems.
Ultimately cryptography is the science of “moving trust from one place to another.” And this solution simply shifts the attacks from one area to another.
I’m going to do an impromptu thread on E2EE and why it’s needed *now* and even simple non-forward secure encryption is a fine first step when it’s literally a matter of life or death for the most vulnerable
This is why end to end encryption matters. Shame on Facebook for providing private messages between a mother & daughter as incriminating evidence, and misleading their users into thinking their conversations are private.
Defining how to perform distributed key generation in practice is *hard* - the FROST RFC only shows how to perform trusted key generation in an appendix. Very excited to see this work on ChillDKG!! 🙌💪❄️
@real_or_random
and I published the first BIP draft of ChillDKG: Distributed Key Generation for FROST. It specifies a protocol for trustless creation of a threshold setup, e.g., for use in t-of-n wallets.
ChillDKG is standalone: it doesn't require external secure channels or a
#MatterLabs
shame on you. You are standing on the shoulders of giants who gave away their work for free to allow our field to flourish. ZK is a public good
ZK is a public good that should belong to everyone.
Matter Labs, the corporate entity behind
@zksync
, has filed trademark applications in nine countries, claiming ZK as its exclusive intellectual property, even though they neither created nor contributed to the creation of this
STAGGERING: Nearly all
@ATT
customers' text & call records breached.
An unknown entity now has an NSA-level view into Americans' lives.
Damage isn't limited to AT&T customers.
But everyone they interacted with.
Also a huge national security incident given government customers
I participated in the NIST threshold workshop today- it is a huge effort and hopefully helpful to the wider adoption of advanced crypto!
I’m also happy to say that we have an *amazing* team for a FROST submission; thanks to everyone involved 🎊 💪
As the CRYPTO submission deadline looms, regular reminder to cite all authors on a paper and not just the lucky first author that is further up in the alphabet. Let’s be a community that gives credit properly when it is deserved!
What is the reasoning for including citations in the max page count for conference submissions? I can't think of any positive reasons for this, and at worst, it disincentives giving credit for prior work in the literature.
Conferences should be safe to attend. Welcoming white nationalists is unacceptable as it puts others at risk. I’m proud to have signed this and expect swift action from
@hopeconf
Happy Monday! I (finally) finished an informal writeup that aggregates my notes on techniques to prove the security of Schnorr signatures and variants thereof. Hope you enjoy!
The way that it penalizes failure and rewards fast thinking. Instead, failure should be a positive learning tool, and we should give slow thinkers (like myself) all the time in the world to solve problems
I gave my first in-person lecture since the pandemic started and it was such an 15/10 amazing experience!! In case anyone is interested, I posted slides here- the talk is about attacks and fixes for distributed key generation protocols:
One of the most misleading things about learning mathematics is that you are seeing the *output* of a great deal of trial, error, sweat, and tears, presented as if it’s obvious, or at best a product of cleverness.