Ian Miers @secparam

My 2018 talk "Satoshi Has No Clothes: Failures in On-Chain Privacy" is still a decent summary of bad privacy designs for blockchains. slideslive.com/38911785/satos… New since then: FHE shielded pools. They make some sense for dark pools, but the global decryption key FHE requires, even if split over n servers, makes them a bad fit for pure payments. Monero went from 10 to 15 decoys and plans to move to full-chain membership proofs (FCMP++) at some point. Oh, and Zcash proving went from 2 seconds on desktop to <400ms on an iPhone.

@FakeIACR It's called code switching, it's to talk to IT people who only care about schemes their email server runs.

It’s not a fight: FHE lets you compute on secrets you don't know, like a darkpool. Zexe gets you arbitrary smart contracts for data you know but want no one else to know. Which is great for intents, identity, compliance, etc. But the prover needs to know all the data for the contract, so if you ran a darkpool in Zexe, the prover would see everything. That said: there's no such thing as fully homomorphic decryption. So with FHE you're trusting someone/ group of folks to hold the keys. At that point, why not jusr use a TEE?

Privacy isn't dead. AI didn't kill it. AI killed "I have nothing to hide." It's never too late to start hiding new things. You might want to criticize your government someday. Or book a vacation at the everyday price, not the one made just for you and your recent promotion.

vitalik.eth @VitalikButerin

3 days ago

It's only dead if you give up I'm not giving up on privacy. I'm doubling down. firefly.social/post/x/2101382…

474 380 3K 534K 300

From a privacy perspective, the core designs are fairly similar. They're both built out of Zexe as the core technique for private smart contracts: you have records, you prove they are in a merkle tree, you reveal a nullifier, run the execution on them. Aztec went a good deal beyond Zexe for the programming model, Aleo is a bit more minimal out of the box. Both are circuit based, under the hood. Aleo has live native USDCx on it, where as I don't think Aztec as a native private stablecoin. Flip side is, USDCx has a view key. Now in terms of implementations, I have not done a comparison. There an infinite number of small privacy leaks you could have under the hood.

@theblockprof Shhhhhhh, don't say that, you will summon the crowd saying "No, freedom money runs on the immutable, permissionless panopticon"

@zksync @VitalikButerin Are your proofs zk yet ?

@odin_free Figures it got confused. But what's the privacy story for strk20 ?

Are STARKs zk yet? In theory zk by blinding is easy. In practice, implementations didn't do it, leading a few of my colleagues to wonder about feasibility. Claude tells me: "StarkWare has Shieldnet, a private payment pool, proven with Stwo. But I can't find the documentation for the zk part — no blinding parameters published, and their Lean verification work targets soundness."

There's a long history of folks shilling privacy and zk when the schemes weren't zk. Someone even tried to trademark zk and they didn't have a zk scheme. "Are STARKs zk yet?" popped into my head before I knew STARKware shipped stealthnet. I assume it got resolved before shipping

What happens to Crypto/Eurocrypt when a proof of security becomes easy? Everyone's first instinct with AI papers is to raise standards, reject misformatted or technically incorrect papers. But it won't work forever. How do you define taste if those (poor) proxies are gone?

mjos\dwez @mjos_crypto

4 days ago

Eurocrypt 2027 received 1059 submissions, up 56% from last year (680). I'm not even sure what "review preferences" are supposed to mean with over 1000 submissions -- "I have familiarity with the subject matter of these, um, 300 papers..?"

5 12 63 11K 9

@badcryptobitch The vaguess was deliberate, there a number of things folks put under that umbrella. And it's a weird umbrella. A snark without trusted setup is ... A snark.

Apple Reference Image is a good example of where you need nuance. When PCC breaks, Apple sees unedited images, which could expose journalists or sources. And they retain identity info for revocation. We need to be clear about those risks. And then there's the treacherous computing angle x.com/TimSweeneyEpic…

Tim Sweeney @TimSweeneyEpic

7 days ago

@timsoret I hate that Apple is legitimizing Adobe's failed "content authenticity" DRM and surveillance initiative. Sounds nice until governments demand identifying information be added, and demand all images without the DRM be treated as suspect, and use it to further censor social media.

13 16 212 15K 16

On device and in-cloud trusted hardware is not perfectly secure or private. For some uses its great, for others catastrophic. For civil-society applications like Apple's Reference Image, we need to keep this in mind. Calling it Private Cloud Compute hides the distinction.

Tim Sweeney @TimSweeneyEpic

6 days ago

@secparam It's super Orwellian to read professions adopting corporate marketing adjectives as if they're statements of fact: "trusted" hardware, "Private" Cloud Compute, "trusted" man-in-the-middle. The world has lost its senses on the underlying threat model. x.com/TimSweeneyEpic…

1 4 47 4K 2

@read_jfk_files As I understand it, this is opt-in. If we are clear about the risks, users, like journalists, can decide if its worth it. Of course, there is the risk this becomes mandatory. I think this is small, for now. But it would be negligible if Apple had never built the system at all.

“Who’s a good boy?!” Hackers just dumped the contents of a Flock camera. They found: 🔴Software explicitly detecting people, not just plates 🔴1.6 million images logged in 21 days 🔴Key to decrypt files stored on the device itself. Finds directly contradict Flock, which claims someone with physical access can't access images. Making it worse,@GainSec warned about the physical access issue more than a year ago & Flock downplayed it. And yeah, the Flock camera logged “Who’s a good boy?!” about every 2 minutes, all while plagued with errors, crashes & reboots. By @dmehro & @josephfcox wired.com/story/hackers-…

keyboard_arrow_left Previous keyboard_arrow_right Next

**Trusted** man-in-the-middle was meant to highlight the contradiction. I probably should have put it in quotes. I agree with you on the identifying information bit being a problem, particularly the revocation parts. Ideally, we never have these systems. My worry is that we don't get to pick if we live in a world where we need them. There’s a decent chance no one trusts any photo, even with some provenance information or entry in some time stamp log.

Apple's new "Reference Image" design suggests something Apple won't say out loud: they don't actually trust the iPhone's Secure Enclave that much. They're probably right, and that has implications both for other proposals to stop deepfakes and for privacy-preserving identity, if it ever gets beyond stopping kids from looking at porn. Reference Image is a mode in the iPhone camera where Apple's servers sign a photo as genuine. The phone sends the raw data, signed by its trusted hardware, to Apple's Private Cloud Compute (PCC) servers, which process it, apply edits, and sign the result. It hides who took the photo, though Apple appears to keep identifying data so it can revoke photos from hacked phones. But why involve Apple's servers at all? It costs money and adds risk for Apple, like demands to deanonymize journalists, so they really have to get Private Compute Right. Maybe Apple couldn't get the image pipeline running inside the Secure Enclave. I doubt it. They could have, or could have with some work. But iPhones get jailbroken, and keys can be extracted from the Secure Enclave. If your threat model includes nation states making deepfakes, assume they'll do it. So I think Apple is using PCC as a trusted man-in-the-middle: it sees everything, so it can try to block exploited devices, and adapt as they see what attackers do. The other thing that relies on secure hardware is privacy-preserving credentials. Google's zk-id proposal uses hardware device binding to prevent credential sharing, and you might want to verify biometrics at enrollment too. But if we start using this for privacy-preserving KYC in banking and cryptocurrency, or for proof of personhood and deepfake prevention on social media, attackers will try to steal credentials or buy and borrow legit accounts. Device binding is meant to stop this. Apple's design suggests they think it can't.

@colludingnode There is no such thing as Fully Homomorphic Decryption.

@yo_yo_yo_jbo The design does seem solid aside from privacy concerns. "They don't trust their phones" was not meant as a criticism, but I think using PCC gets them more security than a purely on phone system would.