Slashdot Mirror
30 Years of Public Key Cryptography
An anonymous reader writes "Public key crypto turned 30 last night, and the biggest names in crypto turned out to celebrate at an event hosted at the Computer History Museum. Voltage Security teamed with RSA to bring together some of the most famous cryptographers of yesterday (Whitfield Diffie and Martin Hellman) and today (Dan Boneh), along with luminaries Ray Ozzie, Brian Snow, and Jim Bidzos. From the ZDNet article: 'NYT reporter John Markoff, who has covered Silicon Valley for 30 years, was master of ceremonies, and started off by saying that no technology has had a more profound impact than cryptography, and that public-key cryptography has been underappreciated for its role in the Internet. Without public key cryptography, ecommerce would be an idea as opposed to an enabler of billions of daily transactions.' You can view the podcast and pictures of the event at the Voltage Security site.."
Let's celebrate the anniversary! Party at d$3vF434. $D%f$sdsN4. Don't miss it!
Where were you when the voynix came?
bayl bhgynjf jvyy unir cevinpl.
(If you do a run of stickers with that on them, kindly tell me, and I'll buy some from you.)
So, is this the 30th anniversary of the public discovery of public key cryptography or the 30th anniversary of the official (publicised) date on which Clifford Cox and co secretly discovered it for a very non-public organisation?
I was a math undergrad interested in large prime numbers and numerical computing when the first hints on what RS&A were doing came out in Scientific American. At that time I had only 3 years programming experience and it was a big thrill to get a public key crypto email system working (first in Pascal on a DEC-20) but I only distributed it to a small group as the university was not yet on the Internet.
I told the story to PZ at a conference about 8 years ago and we had a good laugh wondering how things might have developed differently had that program been distributed on Usenet by someone outside the USA!
It is likely that the NSA discovered public key Cryptography in the late 60's or early 70's. Public Key Cryptography may be as old as 40 years old at this point, but without clarification from the NSA, we will never be certain.
---
Yahma
Proxy Storm - Free Anonymous Proxy Service for security conscious individuals.
Time for it's mid life crisis then, well with the UK Government wanting all our keys soon then it's nice and apt.
I hear that the wheel had quite an impact. Oh yeah and the steam engine. Not fogetting the printing press. Or even plastic. Seriously, do they even think before parroting this nonsense?
GCHQ developed public key cryptography in 1973.
the biggest names in crypto turned out to celebrate at an event hosted at the Computer History Museum.
;)
I'm disappointed that our government missed this key opportunity to ensure their surveillance will go forward willout having to deal with that silly "encryption" and such
Then again, maybe on that note, we can organize a "Islamic Fundamentalist Luncheon" and let some mob-folk "take care of things."
Error 407 - No creative sig found
So, then, by the book, crypto has only been around for, what, 30 hours?
A lot of people seem to forget that one of the first really widespread products that end users in corporations used that fully integrated public/private key encryption was Lotus Notes. I started using it in 1991, but I believe as early as 1989 it was functionally part of the product.
:-)
Sure, others used it before then, but in terms of a widely used corporate end user audience, it was (and still is to some extent) unique.
Yes, you may now rag on Notes if you like -- of course, keep in mind it remains the only real solution for a major corporation that by public key authentication and encryption by default, has a fully functional smtp mta built in, handles the front end needs of end users well enough for salespeople (not like a typical pop or imap client) and of course, fully supports linux as a server platform (and within a few months as a client platform as well).
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
No Zimmerman? Where was the real party?
When I was at school we saw a film on crytography saying a British mathematician had come up with the idea before it had been published to the public by a fairy long time. It was for government use though, and so very classified.
Can anyone back this up? I definitely remember watching the film, and feeling very sorry for the poor bloke who got basically nothing for his idea.
PGP nostalgia?
I don't like to take away from their excellent work, but it is possible, though inconvenient, to do private-key crypto for such things.
Your bank, for example, would need to [paper] mail you a private key to type into your machine (or give you a thumbdrive with it, whatever you like). Inconvenient, yes; you'd need a new key for each company you interact with. Probably it would encourage a few monopolies (amazon and eBay) to dominate, since you'd only need to interact with them by paper once. But not impossible.
Why didn't they invite theo de raadt, responsible for getting ssh into the mainstream?
Public key encryption was invented in 1973 at GCHQ in Britain.
I suppose the commercial victors get to (re)-write the history books then.
"And the meaning of words; when they cease to function; when will it start worrying you?"
I've had a public key for a few years and have cross-signed keys of a few people I know, but most do not encrypt or even sign their emails despite knowing the insecurities of email. I'm surprised that it is not used more commercially, but I have never had a signed or encrypted email at work and that often involves commercially sensitive information.
Could it be that encryption is still to complex for most people?
I will continue to encrypt emails to those I know can handle it and will sign others.
oh come on everyone knows the Americans cracked the Enigma code and single handedly beat the Germans in WW2, invented the steam engine, electricity, telephones, TV and are the World champions of baseball and football !
GO USA #1 *
*not applicable in 191 countries
Can you please point me to either a free email client that is easy enough to use and has a decent interface? Or a plugin for an existting one, that supports this? I'd be very interested in doing this (although I don't know anyone who has the technical capacity to figure out how to read it that wouldn't just ask me to send it unencrypted)
Hopefully in 30 years from now, we will live in a world where encrypting email, IM conversations, personal documents and anything else that you would rather not be public becomes something everyday people do and not something that "geeks" do.
Hopefully we see a world where the major email clients (including Thunderbird/Seamonkey) come with easy to use email encryption out of the box.
Hopefully we see a world where your communications and data are safe from people you would rather didnt see them (black-hat hackers, identity thieves, your worst enemy, your boss, the RIAA etc etc)
We all know public key cryptography was a secret for many years before it became public. Officially GCHQ got there first.
Is this the same John Markoff that got Kevin Mitnick thrown in jail for lying about him in the New York Times?
For all the legitimate uses of public-key cryptography, I seem to think that most uses of it are bad. I see the Xbox, Xbox 360, Vista, Leopard and Tivo using public-key cryptography for nothing but removing the authority of computer owners to decide what software they run on their computer. I see VeriSign getting rich off the VeriSign Tax.
I personally think that it would be far better to make use of shared-secret systems for when you need communication security, like logging onto banks. The solution to phishing is clearly to use a shared secret system, because things like IE7's anti-phishing filtering can be worked around. SRP6 is great, but unfortunately that is based on public-key technology (though doesn't actually involve a public key, like Diffie-Hellman).
I hope that someday it is proven that public-key cryptography cannot be securely attached to an NP-complete problem, and that either a fast discrete logarithm algorithm (*) is found or quantum computers take off.
(*) A fast solution to the discrete logarithm problem implies a fast solution to integer factorization.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Without public key cryptography, ecommerce would be an idea as opposed to an enabler of billions of daily transactions.
Hardly. Phone conversations are not encrypted and can be/are intercepted, yet phone commerce is commonplace. Even in-person credit card purchases are hardly secure and there are a number of websites that do e-commerce without encryption. Without public key cryptography, more attention would be paid to security of the path between your ISP and the vendor. Websites could also have you set up username and password over a more secure channel and then use plain symmetrical encryption for the actual purchase.
Sigh
Complexity may be an issue, but I think it's a relatively minor one.
The biggest issue is that people simply really just don't care. When I try to advocate this stuff to laymen, by far the most common comment I hear is "So what if someone reads my email?" Most people don't think email privacy is worth protecting. Yes, even despite the news stories in the last few years (i.e. the government really is reading your email; it's not just a paranoid crackpot theory anymore).
Another issue is something that has actually gotten worse in the last 10 years. Webmail is very popular. It's nearly impossible to do email encryption correcting using webmail instead of "real" (e.g. POP or IMAP) mail. You either have to trust a foreign system with your keys, or you have to have so much non-web-intelligence running inside the web browser (e.g. a Java applet or something) that it isn't really webmail anymore. And even if you make it sophisticated enough to run on the web browser, you lose one of the major advantages of webmail: checking your email from anywhere, including untrusted machines. (The only way to do it then, is for the user to do the crypto inside their head instead of using a computer.) It's a mess and it just can't be done right. As long as people want webmail, as long as they see it as a good thing instead of a bad thing, they can't have good encryption. (Well, unless they are the admin of the web server. e.g. One person at Google could conceivably use gmail as a secure webmail system. ;-)
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
And without the patent on public-key encryption that covered not just the method but the very idea of it, we might all have secured communications by now. But instead we are not much further ahead except for ssh which at least helps network admins.
I just have a hard time cheering for RSA which did nothing other than patent a mathematical formula discovered by multiple people and prevent it's dfree use in America and other countries that allow software patents.
I was using PGP back in the early 90's and was frustrated that it's use was hamstrung by the patent and US laws on exporting encryption software. What a waste.
Public Key Cryptography was developed by the the British back in the 60's. The only reason that you Americans did not notice was that either they can keep a secret.
It's probably a good time to reflect on the public key cryptography patents.
These shut down public key cryptography work for a long time. It wasn't until those wretched patents expired that internet commerce finally took off. And what have we seen with every other patent since then? People avoid them until it expires. The best patent owners can do is 'submarine' them, a la Unisys.
Rivest, Shamir or Adleman should go down in history as a group of assholes who were at the leading end of the malicious patent trade. When those guys die, I'll be sure to visit their graves and piss on them. Well, Rivest at the very least.
He was there in an encrypted form.
I can throw myself at the ground, and miss.