Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The code obfuscation that DRM implementations use is not provably secure. I don't think anyone would (or should) hide a bitcoin secret key inside of an obfuscated program. There's no formal guarantee of security.

This work, on the other hand, shows a provably secure construction for obfuscation (assuming that some assumptions about the hardness of various well-studied mathematical problems are true). In other words, extracting a bitcoin secret key from an obfuscated algorithm is as hard as insert math problem here. (This is how all cryptography works; e.g. breaking RSA encryption is as hard as factoring large products of primes.) This paper is special because, for the first time, the hard math problem they use (to build the obfuscation) is "reasonable": they've been studied for decades, and no one knows how to break them. (Indeed, a lot of cryptography is built on top of the same assumptions/problems.)

Thus, we would be surprised if someone extracted our bitcoin secret key from our obfuscated program, because it means they solved some "thought-to-be-unsolvable" mathematical problem. This is a much nicer guarantee than the alternative, e.g. with current obfuscation, where we say "oh, it looks pretty random, let's stick my key in" and then trusting that no one will break it. (That's a lot of trust, when you might have a 100,000 Bitcoin at stake.)

Of course, none of this is really feasible; at best, we can securely obfuscate tiny circuits (in the present time). So the main utility is probably to hide keys and the such, not to obfuscate entire programs. This might enable better secure MPC schemes, NIZKs, etc. So I guess, per your question, it's also targeted towards a different use case.

Now, as to why theoretical cryptographers care about obfuscation in general: it's not so much about the direct application of obfuscating programs. (It's not obvious why obfuscation is more interesting than encryption, etc, from an applied point of view.) Instead, from a theoretical point of view, if we can build indistinguishability obfuscation, we can directly build public key encryption, non-interactive zero knowledge proofs, Multiparty computation, etc. etc. (assuming one-way functions). So really, this is a primitive that somehow connects all of the other primitives, which is why theoreticians think it is a big deal.



> I don't think anyone would (or should) hide a bitcoin secret key inside of an obfuscated program.

I can't remember where I read this, or if it was just a hypothetical, but I think I heard of people doing this deliberately as a sort of canary. If the wallet gets drained, then you know someone cracked your obfuscation.


How does obfuscating a key differ from encrypting it?


For example, we could write a program that hard-codes a secret key, and then signs bitcoin transactions with that secret key, but only if the transaction has value less than 0.5 bitcoin. Then anyone who has the program can sign things of small value on our behalf; if the program is indistinguishably-obfuscated, they won't be able to get any additional information about the key itself, or use it in any other way.

I guess just encrypting the key won't let you use it to sign things.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: