The Cryptographers’ Panel 2018

## Overview

This panel at RSA Conference 2018 featured cryptography legends Ron Rivest (MIT), Adi Shamir (Weizmann Institute), Whitfield Diffie, Paul Kocher, and Moxie Marlinspike, moderated by RSA CTO Zulfikar Ramzan. The discussion covered the state of cryptography, security challenges, and emerging threats facing the industry.

## Key Topics

**Elections and Democratic Security** Rivest highlighted election security as a top concern, noting that the Department of Homeland Security designated elections as critical infrastructure. The panel emphasized that while two-thirds of voters now use paper ballots, cybersecurity vigilance on voting systems remains critical.

**Cybersecurity Research Rigor** Shamir expressed concern about the lack of precision in cybersecurity research compared to cryptography. Cryptography has precise definitions and proofs; cybersecurity lacks formalization and theoretical grounding. The field needs to move from qualitative to quantitative analysis.

**Spectre and Meltdown** Paul Kocher detailed the discovery of Spectre vulnerabilities. At a conference, colleague Mike Hamburg mentioned speculative execution flaws, giving Kocher "a bad feeling" that processors were silently making errors. Kocher independently discovered the exploit; simultaneously, Google researchers found the same vulnerability through a different angle (examining CPU cache contents). The discovery revealed that processor design textbooks essentially teach how to build vulnerable fast processors. Challenging embargo situations arose since hardware vulnerabilities affect multiple stakeholders (Intel, ARM, chip makers, device makers, cloud providers, end users) across long supply chains.

**Post-Quantum Cryptography** Adi Shamir reported on the NIST post-quantum cryptography workshop: 82 initial proposals were submitted, 64 remain after withdrawals. Three main categories emerged: lattice-based (26 proposals), coding theory (19), multivariate (9), and hash-based (3). Key findings: most schemes operated in milliseconds to hundreds of microseconds; key/signature sizes typically 1-10 kilobytes. Shamir noted NIST faces difficult selection within their three-year timeline and cautioned that public-key cryptosystems historically require 15 years of analysis before wide adoption (RSA took until early 1990s; elliptic curve until early 2000s). Hash-based schemes and McEliece (since 1978) offer well-tested alternatives.

**Quantum Computing Progress** Whitfield Diffie reported Microsoft's VP claims of a first qubit by year-end and a topological qubit quantum computer within five years, though researchers distanced themselves from these predictions. Quantum progress has been incremental: systems reached 20-72 qubits, but no measurable application advances beyond theoretical demonstrations have occurred.

**Blockchain Hype** The panel characterized blockchain as "security pixie dust." While blockchains offer decentralization, public access, and immutability, they fail catastrophically on scalability, throughput, and latency. They are poor fits for voting (which requires secret ballots and central administration). However, one legitimate application emerged: using blockchain to timestamp digital signatures before quantum computers arrive, ensuring long-term signature validity. Rivest noted similar hype cycles with symmetric algorithms and public key cryptography; surety.com (1994, Stewart Haber and Scott Stornetta) built blockchain-like systems that never commercialized.

**Performance vs. Security Tradeoffs** Paul Kocher emphasized that processors, operating systems, and compilers have been optimized for speed over 50 years with security as a secondary concern. The technology industry must recognize that security is now a multi-trillion-dollar problem, whereas performance gains yield marginal value by comparison. Systems require redesign with security as the primary objective.

**Encryption Backdoors and Exceptional Access** Moxie Marlinspike stated simply: "once everyone has access, it's not exceptional anymore." The panel discussed Apple hosting iCloud data for Chinese users in China with encryption keys held domestically. Paul Kocher noted that technologists don't know how to "magically let the good guys break it and the bad guys stay out." A European Commission report strongly argued that backdoors and master keys are bad for encryption for security—not privacy—reasons. Russia's Supreme Court demanded Telegram provide keys; Telegram refused and was declared illegal in Russia. Iran took similar action. Marlinspike observed that had Telegram encrypted all data end-to-end from the start, refusing government demands would be logically easier.

**Data Privacy and Corporate Incentives** The panel examined Facebook's Cambridge Analytica data breach and GDPR. Marlinspike framed Facebook as analogous to Exxon: indispensable yet despised. The company profits from data collection and surveillance; protecting user data directly conflicts with business interests. GDPR imposes fines of 4% of worldwide revenue for violations and mandates privacy by design, privacy by default, encryption, and data deletion rights. However, Marlinspike cautioned GDPR's consent-focused approach may entrench Facebook's monopoly since most users cannot refuse Facebook without losing internet access.

## Technical Details

- Spectre exploitation code was discovered through basic processor textbook material. - Post-quantum key sizes manageable: 1-10 kilobytes vs. "several tens of gigabytes" for expanded RSA approaches. - Hardware patch complexity: Spectre/Meltdown mitigations use LFENCE/CSDB instructions but are slow; comprehensive tool support remains lacking. - Quantum timelines: incremental progress only; no evidence that 49-72 qubit jumps solved any meaningful problem beyond RSA-breaking speculation.

## Takeaways

1. **Silver Linings**: Election security focus is improving (two-thirds paper ballots); semiconductor designers investing in better hardware. Cryptographic algorithms like AES-256 have negligibly low break probability; solid crypto hardware design is achievable.

2. **Systemic Challenges**: Complexity grows exponentially; defending all attack surfaces simultaneously becomes untenable. Vendors profit from insecurity; regulation (GDPR, election audits) may be necessary.

3. **Long-Term Perspective**: Job security for security professionals is guaranteed; the fundamental problems remain unsolved for decades.

4. **Design Philosophy Shift Needed**: Systems must prioritize security over speed; bifurcate systems (e.g., ARM's big.little for power) with security variants. Privacy and cryptography technology form infrastructure for a desired world.

5. **International Convergence**: Multiple governments legislating against encrypted systems without backdoors reveals a collision between technical reality and political demand, with no technical solution available.