Themes from Real World Crypto 2022 | Hacker News Reader

Themes from Real World Crypto 2022

blog.trailofbits.com

80 pointsmooreds17 comments

microphone noise side channels are pretty wild!

reminds me a bit of 80s era personal computers that had poor noise characteristics where you could "hear" all sorts of rich noise as the computer did things.

steganography is an interesting space. probably the next frontier for vpns.

Really enjoyed the conference this year, sad that I probably won't be able to make it to next year's event in Tokyo. Definitely take a look at the technical program [0] if you're at all interested, I think pretty much all the talks are up on YouTube now.

0: https://rwc.iacr.org/2022/program.php

> Years of vulnerabilities have led to Intel’s decision to remove SGX from its next generation of consumer CPUs

Isn't this a bit misleading? Intel is still adding SGXv2 on the Xeon processors. Isn't it most likely that there were just no real use cases for PCs and they just decided to focus on servers?

Author here: the post says “consumer CPUs”; I didn’t mean to imply that it’s being deprecated across the board!

More generally, the point of that section was that we’re simultaneously seeing more trusted hardware introduced in consumer-facing roles and seeing pretty severe breaks in the guarantees made by that hardware (in no small part thanks to the fact that it’s much easier to break a thing when you have direct access to it.)

> of 44 cryptographers surveyed across 27 major open-source cryptography projects, only 17 had actually used automated tools to find timing vulnerabilities, even though 100% of the participants surveyed were aware of timing vulnerabilities

I wonder if this is about the larger mindset difference where some just find it harder to focus on 'breaking' things. I.e., not every web engineer is also a pentester. (Should they be?)

Nice write-up, easy to understand for a non-specialist and well-linked.

NB: the conference is about cryptography, not crypto"currency".

Something that irritates all cryptographers!

I'm not really into either and it annoys me.

There is non-trivial overlap between the two, especially in projects using fairly advanced crypto like zkSNARKs, threshold signing protocols, pairing-based accumulators, etc. in general the cryptocurrency space is far ahead of normal tech in deploying advanced cryptography.

Submission title has it now: “Themes from Real World Crypto(graphy) 2022”

If we’re gonna ditch bad abbreviations, though, how about NB? It’s not in common use in most places, and isn’t much shorter than, say, “Note:”.

I think it's fun and pretentious, so I vote to keep it! Besides, "NB" emphasizes that we should note well, not just note. Are you implying we should note /poorly/???

Yeah it's probably not practical, though. But does everything have to be?

When the abbreviation exists to save time, yes.

That's why it exists for you maybe! For me it exists to be fun and historical.

Then you might be neglecting the needs of a major party in your communications.

Thanks, I updated the title to make it clearer.

For those of us still beating the "crypto == cryptography" drum, maybe it'd be more satisfying to leave the title as it was ;)

LOL so true

Reply on news.ycombinator.com