The post-Watergate dream of private electronic cash is still alive. We have both private cryptocurrencies like Zcash and (mostly) private stablecoins. Funnily enough, usable wallets are one of the harder problems here.

The AI cyber doom and gloom just isn't creative enough. Imagine a worm that updates all PHP websites, adding user-demanded features, but then makes the sites brutalist. Or there are competing swarm ideologies and you're like: the DMV website hasn't been the same since the anarcho-syndicalist hive mind patched it.

Of course not. At the same time, it would be more secure than d=4. And that's saying something.

To be fair the joke has as much entropy as those keys.

Surprisingly, an LLM does better here. Even Hauki does the right thing (though on low, it messes up letting me download it)

Relevant XKCD strikes again, this time for real. A certificate authority actually generated private keys where 4 was part of the key.

NIST curve bounty does not believe in private money. It's all just math and proving someone is wrong on the internet.

I'm curious about this too, and the interplay between encryption, commerce, and payments. Privacy and commerce come up in early writings, both that text and "New Directions in Cryptography." How many of the early folks cared about privacy for payments (dollars, not bitcoins or Sealand dollars)? Cindy Cohn pointed out that cryptocurrency had lost many parts of the broad coalition that supported encryption, despite payment privacy being a similar issue today. And there are a number of reasons for that, some of which you alluded to, and another of which is almost no one in cryptocurrency cares about privacy. But was it more fundamental, were electronic payments just ignored ? What did folks think of early ecash proposals.

IBM, especially then, was the establishment. And the boring side of it. So its simply unexpected.

Ironically, after Hillary Clinton got her leaked emails authenticated by DKIM signing, Matt went on to write a blog post "Ok Google: please publish your DKIM secret keys"blog.cryptographyengineering…

"Computers now constitute or will soon constitute adangerous threat to individual privacy " Some of the first notions of cryptography, privacy , and computers came from someone at .... fucking IBM. Yes, this the Feistel of Feistel network fame. These guys were not just in it for the math. (from Steven Levy's Crypto, written in january 2001 when Crypto meant Cryptography)

Occasionally your cyberpunk future is a tragic comedy. But its never a utopia.

Wouldn't we assume NSA made that key very securely? Dual EC is known to be backdoored ( and I do mean known, we have letters from US senators asking for the NSAs lessons learned report). IIRC the backdoor was knowing the discreet log of a generator.

Sure, but if we're that constrained by perforated, why are we debating security of math assumptions, not performance? Remember , my original point was this isn't a serious debate

You couldn't up until now. But this debate is happening now. And it's not a debate about performance. we're talking about rollups, where you need a single aggregate or recursive proof of a batch of transactions. If we presuppose that exists for both lattice and hash based proof systems, then you'd just post both proofs. Of course, the state of aggregate lattice proofs is, at least to me , an unknown. But no one seems to be disputing you can plausibly build a roll-up out of them with some more research. If that was in dispute, we'd not need to debate lattice vs hash assumptions. So, like I said, if this was a serious debate about long term safety, we should expect discussions of hybrid systems. Or debates on performance

Dissent is essential to democracy. And when it's needed most, you need either courage or anonymity. We've repackaged anonymity as privacy, dressing it up in friendly clothes. But no one thinks they have privacy today, and it's hard to articulate why that matters. Anonymity and privacy aren't the same thing. Even if they know everything about you, you can use AI to disguise your writing style, use Tor or Apple Private Relay, make a burner account, and still post anonymously. For now.

No, it's just odd. This isn't framed as a debate over performance.If both schemes are comparable, hybrids get much more security for double the cost. And if you were really, earnestly, worried about assumptions, ai cryptanalysis, and long term viability, you'd at least consider it.

Thats much less of a point when are talking about deploying a scheme with a fixed hash function or lattice and hardware support. And the fear of catastrophic breaks. And again, if this debate was about safety and not marketing, you'd see calls for hybrid schemes.

Its odd no one is calling for hybrid solutions for zk proofs. Instead everyone is arguing their proof system must win. And making flat out wrong assertions, like hash functions don't have structure to break.

Yes. But this misses the context here. There's a terminally online debate between folks trying to sell hash-based solutions as the future of cryptocurrency and lattice-based ones. This is mainly for "zk" proofs (usually not zk) for rollups. No one's taking the reasonable position: let's do hybrid solutions. It's worth remembering both lattices and hashes have structure. We've had at least two hashes (SHA-1, MD5) broken since 2002, and no doubt some lattice schemes I'm forgetting about. And that's before we get into the fact that zk proof depend on more that just hashes or lattices. How many times can we safely recursively prove , for example?