The Cost of Cryptography

In other news, a lot of recent effort in cryptography has gone toward the study of so-called "indistinguishability obfuscation." The idea is much what you'd think from the word obfuscation: you want a scheme that garbles a program in such a way that you can still run it but can't read the source code.

The technical conditions are a bit more specific (that an attacker can't distinguish between the encryptions of two functionally equivalent programs), but the study of indistinguishability obfuscation (abbreviated iO), has been called a "watershed" in cryptography.

Perhaps an even better introduction to these and related issues is Moxie's famous "changing threats to privacy" talk from 2010/2011--especially the first half hour: https://www.youtube.com/watch?v=Uxz7r4E2li8

I have pointed many friends--technical and non-technical alike--to Moxie's talk because in addition to some basics of how crypto works, it helps people understand why cryptography is essential to open societies in historical context. The linked essay points out some important basics, but it doesn't really explain why things like the deniability properties of OTR, trust agility for CAs, or perfect forward secrecy are so vital in today's world.

Really great article that summarizes modern cryptography. I'm excited about the potential of fully homomorphic encryption and it's applications in search and health care. Or pretty much anything where sensitive data is involved. Whomever figures that out is going to be very wealthy.

An interesting point on the article is how we are dependant to centralized CA. If the notion of CA was also linked to Web-of-trust, it will make it less prone to governmental intervention. Because of the actual legal system, it is possible for court to obtain by secret warrant a copy of the main key of a website. Why they don't request a copy of the main CA key and fake a new upgraded key after an event like heartbleed?

A pretty good explanation for laypeople, featuring:

* One Time Pad (OTP)

* symmetric ciphers

* asymmetric cryptography (minus signatures)

* homomorphic encryption (at least, the overall principle)

* side-channels attack

Giving more practical examples could have helped though (e.g. HTTPS, GPG, etc)

Apart from the article, nautil.us is such a great platform that provides great content all the time. I'd read anything published on it even if I have no clue about the topic.