TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Cryptographic obfuscation and 'unhackable' software

66 点作者 clarkm超过 11 年前

6 条评论

yoha超过 11 年前
I had heard of this paper but reading a summary now makes me link the idea with secure verifiable computing [1]. This is basically the same base idea where A wants to send a program to B so that B can use the program but not know what it does. In the case of the original article, you want B to get back the results by himself (like in a conventional application).<p>However, there is another approach where B is just an untrusted third party where you want to outsource the computation. In other words, A wants to get back the result and check it, without B knowing anything of it. There is actually a(n almost) generic construction that allows that [2]. In short, you consider the boolean circuit of what you want to compute and transform it so that the inputs are keys necessary to unroll the computation, until getting the encrypted result. More specifically, step 1 gets the input keys and compute some new key (amongst several possible); step 2 use this key for next computation and so on.<p>On the one hand, this constructions are very neat because they give us a better understanding of what we can do with cryptography. On the other hand, they can be a little frightening because they are the theoretical grail for DRMs and such.<p>[1] <a href="https://en.wikipedia.org/wiki/Verifiable_computing" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Verifiable_computing</a><p>[2] Part 1 of <i>A Proof of Security of Yao&#x27;s Protocol for Two-Party Computation</i>, <a href="http://eprint.iacr.org/2004/175.pdf" rel="nofollow">http:&#x2F;&#x2F;eprint.iacr.org&#x2F;2004&#x2F;175.pdf</a>
评论 #7276464 未加载
评论 #7276665 未加载
unwind超过 11 年前
Perhaps this is just my Stack Overflow reflexes, but:<p>The string argument to SuperSecretPasswordProtectedStuff() should be const (reference, perhaps even) and of course printf() shouldn&#x27;t be used in C++.<p>It&#x27;s ... fun and interesting that such a super-minimal example of source code (from a <i></i>research professor<i></i> for crying out at 200 dB(A)) has those kinds of &quot;sloppiness indicators&quot; in it.<p>Or am I just being grumpy?<p>Regardless, I&#x27;m glad to see someone trying to shed some proper light over the obfuscation research, I too was underwhelmed by Wired&#x27;s coverage. I&#x27;m more or less clueless when it comes to all things security-related, though.
评论 #7277765 未加载
评论 #7276404 未加载
评论 #7279021 未加载
cuu508超过 11 年前
The article leaves me hanging. Long introduction, describes IO and EO, and when it&#x27;s time to talk about their uses, it just handwaves &quot;lots of exciting stuff coming in future!&quot;<p>&gt; obfuscating &#x27;symmetric&#x27; primitives like pseudorandom functions<p>So how would be obfuscated and indistinguishable RNGs be useful, if they generate the same numbers? I&#x27;m sure there is something there, but the article doesn&#x27;t tell :-&#x2F;
评论 #7276911 未加载
blueskin_超过 11 年前
&gt;Malware authors and DRM folks<p>Aren&#x27;t those largely one and the same?
评论 #7322875 未加载
DonGateley大约 11 年前
What immediately came to my mind is the attack potential of this methodology. Is there one? Seems to me it makes possible the writing of undetectable malware, no?
RaquelCBixler超过 11 年前
Disclaimer: No rhinos were harmed during the writing of this article.