7
$\begingroup$

If a researcher manages to make a cryptanalytic breakthrough on a cryptographic algorithm or protocol that is in use, what should they do?

Has this ever happened before? What are the implications for release and how do those relying on such systems ensure they are not caught in a situation where the crypto-system on which they depend is trivially broken?

Specifically:

  • What details would you make available online?
  • Who would you release full details to?
  • How are affected parties notified?
Improve this question
$\endgroup$
7
  • 1
    $\begingroup$ I'm not sure this is the right site for this question. This is not about cryptography, more about ethics, I suppose. $\endgroup$
    – Paŭlo Ebermann
    Commented Aug 26, 2011 at 10:44
  • 2
    $\begingroup$ @Paŭlo I agree that the field of cryptography needs to be able to discuss attacking and defending in a completely abstract way, using the terminology such that it's unloaded from the ethics of any particular human situation. More often than not, it's the real-world defender who benefits from the 'attack' research anyway. Nevertheless, it's probably not a good idea for any researcher to be completely oblivious to the real-world implications of their research. It think it's an important (even if maybe a little far-fetched) question that needs to be asked. If not here, then where? $\endgroup$
    – Marsh Ray
    Commented Aug 26, 2011 at 14:18
  • $\begingroup$ I once faced a similar situation, for a much lesser target. Here is what I did $\endgroup$
    – fgrieu ♦
    Commented Aug 26, 2011 at 15:31
  • $\begingroup$ I've edited the question to make it more generic; let me know what you think (I can always roll it back, or the OP can). I think, personally, that it is a difficult case to decide if this question is in-scope, so I'll be guided by everyone else. Also, I've introduced an ethics tag which may or may not be a good idea - anyone with any better suggestions (soft-question?) please shout. $\endgroup$
    – user46
    Commented Aug 26, 2011 at 15:51
  • 2
    $\begingroup$ First of all, you should never assume that you're the only party that knows about it. $\endgroup$
    – Marsh Ray
    Commented Aug 28, 2011 at 12:35

2 Answers 2

Reset to default
6
$\begingroup$

Well, first off, the question doesn't arise that often in practice. People do find cryptographical weaknesses; however, generally they are purely of theoretical interest, or if they could be used in a real attack, it may take quite a while before someone figures out how to use it. As an example of the second case, Ms. Wang announced an efficient way to create MD5 collisions; this is a severe break of the MD5 security properties, but it took people quite a while to figure out how to translate that into being able to obtain a bogus certificate (by asking for an innocuous one from a CA).

On the other hand, it does happen on occasion; one example that springs to mind is WEP and the key recovery attack.

Now, in my opinion, the ethical thing to try to do is to get people to stop using the broken protocol, and switch to something which doesn't have known weaknesses. However, in practice, that appears to be difficult. Once they have a system in place, quite a lot of people are loathe to update it. In addition, when cryptographical hardware is involved, sometimes the fix involves hardware modification, and so updating things would involve real money (rather than just a software update). One example of someone ignoring an announced attack would be the TJX credit card breach; this attack was done using the WEP key recovery attack that was announced 5+ years earlier.

So, what should we do? Well, I don't see any good options. Not publishing the result doesn't appear to work (we leave the weaknesses in place for the blackhats to find and exploit). Publishing the result does mean that some will update, but others won't bother. Publishing the fact that we have a result will generally mean that you won't be taken seriously (unless you're already a cryptographical Big Name), and the blackhats will be alerted that there is a weakness.

My personal feeling is that publishing the result is the "least worse".

[Hmmmm, we're supposed to avoid statements based on opinions; for a question about ethics like this, I don't see how I can avoid it]

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ I think there's enough history and data at this point that we can say full disclosure is a good principle and default course of action. Generally the only parties opposed to it are those who actually want (perversely) the vulnerable state to persist longer. $\endgroup$
    – Marsh Ray
    Commented Aug 28, 2011 at 12:31
  • $\begingroup$ Depending on when you consider something a breakthrough I believe this happens much more often than one thinks. Consider the integer overflow on BitCoin: the idea behind the currency is decentralization through open source code of a certain peer to peer protocol. He found a flaw in its implementation. Instead of trying to contact a "certain" centralized person, he showed to everyone listening to the blockchain what the problem was and anyone with debugger skills could find the problem. Also consider that windows virus that closed the vulnerability it used. $\endgroup$
    – propaganda
    Commented Jan 22, 2012 at 18:48
1
$\begingroup$

I landed on this question having been struggling with a narrower version, and associated conundrum: What should a number theorist do is she discovers a fast factorization algorithm? By "fast", I had been considering, the specific case of being able to factor $n = p \times q$ (where $p$ and $q$ are each 2048 bit primes) in about 1 week using a single Intel Core Ultra 9 285K.

It seems to me that the solutions offered by @JonRB (on a now-closed question at SE Security) are not ideal. Every significant nation state, and every significant criminal organization, will want access to the algorithm and will also want to keep the algorithm secret for as long as possible. The discoverer will potentially be in significant danger.

Note Method 1 (which was in my original unedited answer) is actually flawed, as pointed out by @poncho in the comment below. I have given a corrected method after this flawed one, but I think it is useful to leave the flaw ... because it shows how easy it is to slip up!

Method 1

Assuming that the discoverer's intent is one of altruism rather than self-interest I suggest the following approach:

  • Use a service that incorporates Tor to announce the discovery without disclosing the method (e.g., one of the secure submission methods of some well-respected newspaper).
  • Invite submissions, prior to some closing date, of 4096-bit products as challenges for factorizing.
  • Factor the challenges and post the results.

At that point, the crypto community will take serious notice because you will have provided a zero knowledge proof of the existence of the algorithm. Advantageously, you will not have revealed your identity, or location, or the algorithm but you will have time to do all those things when it appears safe to do so.

Method 2

The critical difference between this, and my flawed method above, is that this is zero knowledge. I was too much focused in Method 1 on not revealing the factorization method, and forgot that my "proof of possession of a method" could be used as an oracle.

So ...

  1. Use a service that incorporates Tor to announce the discovery without disclosing the method (e.g., one of the secure submission methods of some well-respected newspaper).
  2. Offer to engage, with your readers, up to some stated closing date, in a statistical zero-knowledge protocol of the kind described in an open access conference paper by Poupard and Stern (2000).
  3. Make public the details of the interactions at stage 2
Improve this answer
New contributor
CrimsonDark is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
$\endgroup$
4
  • 1
    $\begingroup$ The problem with this is this is not zero knowledge - someone can use you as a factoring oracle. Instead, what I would recommend would be publishing anonymously that you have an algorithm, along with the factorizations of the previously unsolved challenges from the RSA factorization challenge en.wikipedia.org/wiki/RSA_Factoring_Challenge . By showing multiple factorizations of composites believed to be hard, you give evidence that your statement 'I have a factorization algorithm' is correct, without leaking anything else. Of course, this works for RSA - not in the more general case $\endgroup$
    – poncho
    Commented Dec 11 at 14:17
  • $\begingroup$ If you're talking of altruism, that's like patriotism in putting your country first. As discussed here; $\endgroup$
    – Paul Uszak
    Commented Dec 11 at 23:42
  • $\begingroup$ @poncho Thank you for pointing out my oversight. I have amended my answer but leaving the old, flawed answer within the text. $\endgroup$
    – CrimsonDark
    Commented Dec 12 at 10:21
  • $\begingroup$ regarding the flaw in method 1: I think you could indeed take 4096-bit challenges, as long as you don't reveal the factors. Just use the factorization to compute the private exponent, sign a constant string like I can break RSA and publish the signature. This method could also be generalized to other signature schemes. $\endgroup$
    – Aemyl
    Commented Dec 13 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.