3
$\begingroup$

According to a Reddit post I am participating in, SpiderOak “repented” of its incorrect usage of the term “zero knowledge” in 2017, as shown here:

https://medium.com/@SpiderOak/why-we-will-no-longer-use-the-phrase-zero-knowledge-to-describe-our-software-ddef2593a489

NordPass has yet to walk back its claim to a zero knowledge architecture:

https://nordpass.com/features/zero-knowledge-architecture/#

Is it technically wrong to claim that “no knowledge” is the same as “zero knowledge” as SpiderOak previously did? If so, why?

Improve this question
$\endgroup$
2
  • $\begingroup$ Reddit comment: reddit.com/r/cryptography/comments/10nc1np/… $\endgroup$
    – tdMJN6B2JtUe
    Commented Feb 26, 2023 at 11:34
  • 4
    $\begingroup$ Marketing texts attempt to find short and well memorable definitions for important product features. That's why the wording "zero-knowledge" is understandable in the cases mentioned in the OP. But despite the product features have nothing to do with zero-knowledge proofs, discussion of marketing texts is off-topic on Crypto SE. I suggest to close the question. $\endgroup$
    – mentallurg
    Commented Feb 26, 2023 at 13:25

1 Answer 1

Reset to default
2
$\begingroup$

The cryptography outlined on the NordPass page is not using zero-knowledge as that's understood in a cryptographic context, which is (per the Handbook of Applied Cryptography, chapter 10)

a zero-knowledge protocol allows a proof of the truth of an assertion, while conveying no information whatsoever about the assertion itself other than its actual truth.

Instead, NordPass uses zero-knowledge architecture (or zero-knowledge encryption, zero-knowledge cloud storage) to mean they do not hold the encryption key to the user data they store (including password vault). They describe a system with a master password, turned into a key for encryption with XChaCha20, by key stretching using Argon2. All this is symmetric cryptography, entirely unrelated to zero-knowledge as considered in the first paragraph and quote.

At least I do not see them using zero knowledge to qualify one of their protocol, or a proof made of something in their system.

Improve this answer
$\endgroup$
2
  • $\begingroup$ This article may show the results of widespread ignorance spreading ever wider: howtogeek.com/811527/what-is-zero-knowledge-encryption $\endgroup$
    – tdMJN6B2JtUe
    Commented Mar 2, 2023 at 11:34
  • 1
    $\begingroup$ @brethvoice: the above article indeed makes several errors: it talks of "zero-knowledge encryption" as if this marketing term was standard in cryptography; AES-256 is said to be a protocol; and while it acknowledges that "Zero-knowledge encryption and zero-knowledge proof are different concepts", it twice states ZK proof is used for password verification in zero-knowledge encryption, which AFAIK is not even attempted in NordPass. $\endgroup$
    – fgrieu ♦
    Commented Mar 2, 2023 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.