Twenty Years of Cryptography in the Open Literature
G. R. Blakley
Department of Mathematics
Texas A&M University
College Station, TX 77843-3368
blakley@math.tamu.edu
1. Introduction
This paper concentrates on the real-world problems cre-
ated in the last two decades by cryptographers who publish
in the open literature, and mentions only incidentally what
gave rise to these problems – the solutions we gave to vari-
ous theoretical problems. often of our own posing.
For the last twenty years, the annual IEEE Symposia on
Security and Privacy have provided us with a stimulating
and encouraging environment within which to expand cryp-
tography’s structure and visibility, while exposing us to crit-
icism from workers in other security-related areas. Cryptog-
raphy has been an important component of S&P, but seldom
a major one. Much work mentioned below is from confer-
ences other than S&P. But S&P’s influence has been ubiq-
uitous and formative for the worldwide community of open
literature cryptographers.
To set the problems stage, here are six propositions for
consideration, not necessarily for acceptance.
I. Not all secrecy or authentication or integrity systems
have security proofs, but all have lifetimes.
II. The signing (decrypting) functions and the sealing
(encrypting) functions of public key cryptosystems or dig-
ital signature schemes are quite different replacements for
glued envelopes or inked signatures. They aren’t merely
variant forms of these old-fashioned objects.
III. Bandwidth expansion is not necessarily either a
drawback or a strength of a system, merely a feature.
IV. Shannon perfect security of a system is based on the
(often false) assumption that no attacker can do better than
model the “random” numbers the system user employs as
independent uniformly distributed random variables.
V. The Kerckhoffs principle is neither a correct descrip-
tion of, nor a self-evident prescription for, all secrecy sys-
tem design projects.
VI. A billion dollars is tons of money. So you can’t loot
a big vault in a trice. “Ponderability” is neither a drawback
nor a virtue of gold or of paper money. It is merely a feature,
which can be mimicked electronically.
2. 1973 to 1980
In 1974, George Purdy [1012] published a high-security
log-in scheme based on sparse polynomials over finite
fields, and therein publicized the idea (though not the ter-
minology) of a one-way function.
In 1976, Whitfield Diffie and Martin Hellman [0345] in-
troduced the general ideas of one-way function, of trapdoor
one-way function, and of digital signature, and introduced
an exponentiation-based key exchange scheme.
The (then) U. S. National Bureau of Standards adopted
an algorithm designed largely by IBM as a federal Data En-
cryption Standard in 1977.
In 1978, Ron Rivest, Adi Shamir and Len Adleman
published their public-key (i.e. unsymmetric, i.e. two-key)
number theoretic cryptosystem based on exponentiation,
which gained lasting celebrity for its bijective feature,
which suited it well to digital signatures, among other
things.. That same year, Ralph Merkle and Hellman pub-
lished [0857] their trapdoor knapsack public key cryptosys-
tem.
In 1979, Adi Shamir [1110] and I [0148] published
threshold schemes, the type of cryptographic object most
naturally capable of provably exhibiting Shannon perfect
security.
By 1980, people were arguing that perhaps even cryp-
tosystems could be shown secure – by means of complex-
ity theory or other approaches. However, in 1980, Shimon
Even and Yacov Yacobi published [0379] an example of a
cryptosystem which is NP hard to break but almost always
easy to break. To many, this looked like support for Bob
Morris’ asseveration that secrecy systems typically have
lifetimes, rather than proofs which guarantee their security
forever.
3. 1980 through 1999
Some of the important developments in cryptography
over the twenty year lifetime of S&P to date are the fol-
lowing.
George Davida, Richard DeMillo and Richard Lipton de-
livered a paper [0003] to the first S&P symposium, in 1980.
Davida pointed out at S&P that threshold schemes could
exhibit types of security very far from Shannon perfect se-
curity,viz. merely cryptographic security. In 1983, E. D.
Karnin, J. W. Greene and Hellman, also discussed threshold
schemes involving merely cryptographic security [0662].
In 1984 Catherine Meadows and I generalized thresh-
old schemes to ramp schemes [0151], which are more eco-
nomical than threshold schemes, but exhibit only Shannon
relative security. In 1987, Ito, Saito and Nishizeki pub-
lished a paper [0625] on access structures, a generalization
of threshold schemes in yet another direction – one in which
coalitions of very different size levels have the same power
to reveal the secret. In the 1990s, Gus Simmons [1141,
1142, 1145] published very significant real-world-grounded
investigations of access structures.
The only PKC to rival knapsack and RSA in popularity
has been the 1985 elliptic curve PKC due to V. S. Miller
[0878], and extensively investigated by Neal Koblitz [0695]
and others.
In 1994, the National institute of Standards and Tech-
nology (the successor of NBS) adopted a Digital Signature
Standard, and is now proceeding toward adoption of an Ad-
vanced Encryption Standard which will to some extent re-
place DES, which is nearing the end of its useful life.
4. After 1999
DES offered no security proofs. The hoped-for proofs
to back up knapsack or RSA security never materialized.
The one is, for many practical purposes, broken. And the
other relies on increasingly lengthening keys (thousands of
bits for some current applications). As regards Proposition
I above, it looks as if Morris was right. Security proofs
haven’t lived up to our hopes. But lifetimes are everywhere.
As regards Propositions I and II, systematic purposeful
routine disavowal of PKC keys does not get enough atten-
tion. And the real worth of PKCs may not be fully realized
in the real world until we look more closely at every way in
which digital signatures differ from inked or stamped sig-
natures, and public key encryption differs from sealed en-
velopes. Also, individual PKC encryptions and digital sig-
natures, or even the keys used, may have to bear “use by”
dates like those on dairy products.
Memory and bandwidth are cheap. Who needs slavish
adherence to the no-bandwidth-expansion paradigm which
has recently been so dominant in cryptosystem design? The
general theory of codes [0002] suggests that we can now
incorporate homophone and polyphones, nulls and voids
[0002] into today’s cryptosystem design in such a manner
as to increase unicity distance. As regards Proposition III,
we might want to do a bandwidth-cost/security-benefit anal-
ysis of this approach to cryptosystem design.
Shannon perfect security imposes a bandwidth expan-
sion cost which may be prohibitive in some applications.
As regards Proposition IV, secret sharers may want to re-
place Shannon perfect security with less stringent types of
security, as well as to accept degraded modes of secret re-
covery, in order to enhance various types of functionality.
Major, sophisticated governments with important inter-
ests design cryptosystems secretly in-house. As regards
Proposition V, we need a less worshipful, more mathemati-
cal, view of the Kerckhoffs approach– perhaps a Kerckhoffs
“phase diagram” which instructs many of the small players
to use secrecy systems with publicized design principles,
but assures some of the big players that they are well ad-
vised to use home-grown systems whose design principles
are secret.
Some vaults are, or should be, bulky places full of bulky
things. Access structures constitute a naturally bulky, nat-
urally secure cryptographic storage vehicle. They can be
artificially bulked up to any desired degree of bandwidth
expansion. As regards Propositions III and VI, Bob Blakley
[0001] argues that electronic money could be stored elec-
tronically so that even an allowed coalition can only carry
out the vault’s contents at a certain rate because of band-
width constraints. An access structure vault which could not
release more than a million dollars an hour would be neither
a blessing nor a curse. It would simply have a depletion-rate
feature, which hinders looting.
5. References
0001 Bob Blakley, The emperor’s old armor, in Proceedings of the
ACM New Security Paradigms Workshop, 1996, ACM Press
(1977), pp.
0002 G. R. Blakley and I. Borosh, A General theory of codes,
I, Basic concepts, in Contributions to General Algebra 10,
Proceedings of the Klagenfurt Conference, May 29 - June
1, 1997, Verlag Johannes Heyn, Klagenfurt, Austria (1988),
pp. 1–29.
0003 G. I. Davida, R. DeMillo and R. Lipton, Protecting shared
cryptographic keys, in Proceedings of the 1980 Symposium
on Security and Privacy, IEEE Computer Society, Long
Beach, California (1980), pp. 100–102.
0004 A. J. Menezes, P. C. van Oorschot and S. A. Vanstone, Hand-
book of Applied Cryptography, CRC Press, Boca Raton,
Florida (1997), xxviii + 780 pages.
To keep this paper short, every other reference is of the
form [wxyz], and is one of the 1276 serially numbered ref-
erences to be found on pages 703 - 754 of reference [0004]
immediately above. Thus [0345] is the 1976 Diffie/Hellman
New directions in cryptography IEEE IT paper cited on
page 717 of [0004].