Matthew Green

Cryptographers Held an Election. They Can’t Decrypt the Results.

See if this works. If not I’ll snap screenshots. www.nytimes.com/2025/11/21/w...

The new stuff that’s happening with function secret sharing is really cool! Not quite applicable to this yet. But I feel like maybe there’s a future where it helps.

There’s all this cool work on function secret sharing and correlated pseudorandomness, where you can get structured output without interaction. But that work usually requires a setup! And most of it supports only 2-of-2 sharing. But I feel like we’re getting to a place where maybe this could help.

They’re so terrible to use.

Oh, ok. I was just looking at the code. I’m don’t want to give Ben more unpaid volunteer work, I just think it’s interesting to have people research better low-interaction setup protocols. Interaction at key gen time is annoying.

I just think it’s interesting that Helios (out of the box) doesn’t support threshold decryption. Not even the IACR’s fault exactly. I can’t lay it at Helios’s feet either, since that seems to be maintained as a volunteer project by Ben.

Anyway it’s a fun story! Let’s celebrate people caring!

Seems like Helios (out of the box) just doesn’t support it. So not even an IACR thing.

Well Lagrange and DKGs are pretty complicated, /*TODO*/

(I’m actually being serious. DKGs suck. If you’re focusing on research, non-interactive distributed threshold keygen protocols that are practical seems like a good place to be working.)

Which ones?

But that doesn’t mean you should ever trust an academic cryptographer to hold important keys. You probably shouldn’t trust us with our car keys.

But those are still much better problems to have! You may hate cryptocurrency but it’s really accelerated our progress in being able to secure and manage keys. Nothing solves a security problem like piles of money and constant free red teaming done by North Korea.

The joke is that you have a software security problem, you use cryptography to solve it, now you have two problems: a software security problem and a key management problem.

Cryptographers Held an Election. They Can’t Decrypt the Results.

Trying to think of something serious to say about the “cryptographers lose the key for the cryptographer election” story and, mostly, hey: I just love that cryptographers are actually using the weird cryptography! www.nytimes.com/2025/11/21/w...

Cryptographers Held an Election. They Can’t Decrypt the Results.

Keys are hard. www.nytimes.com/2025/11/21/w...

cloudflare's on-duty IT staff bangs on the doors which I have padlocked from the inside as I calmly break open lava lamp after lava lamp and drink the contents

I know this is super basic stuff but I wish it had all been spelled out better when I was learning this stuff. All sorts of weird quadratic stuff shows up in ZK proofs with no real explanation.

Everything in MPC and ZK comes down to how many sequential multiplications a private computation requires. In (non-interactive ZK) the answer is basically two, whereas in MPC the answer is “many” unless we’re willing to decompose the computation into many rounds.

Because cryptographic vulnerabilities against US systems could potentially be exploited at large scale by countries that are US adversaries. You want those bugs shut down, not hoarded. This seems like a no-brainer but past behavior by the NSA was different.

As I understand this: show up with a 0click in a messaging app, cool. Show up with a break in Signal’s PQC implementation, that gets fixed.

It’s actually excellent policy. But allegedly new policy.

I want to reiterate the “mountain of salt” comment here. No idea if this is for real, policy from the top, just someone’s opinion. But it’s kind of intriguing.

A wild rumor I heard: US agencies that purchase vulnerabilities have explicitly told their vendors *not* to bring them vulnerabilities in encryption protocols (like Signal or WhatsApp), unless they want those vulnerabilities disclosed/fixed. (Take this with a mountain of salt.)

I read it and I’m pretty unsatisfied. He was coerced in a way that put the entire academic community at risk, and his answer is that he was cowardly.

In his defense I am going to assume that he organized the newspaper leak, and that’s how he got it public. But he should have made them fire him.

I would have appreciated this more if it had been made public at the time.

Mafia governance in action

"the only offer on the table was that I needed to resign by 5pm that day or the DOJ would basically rain hell on UVA... If I did not resign that day, I was told that the DOJ would extract/block hundreds of millions of dollars from UVA before they would even negotiate."

Law enforcement: we need to break encryption to get access to Signal to protect the children!!

Also law enforcement: for years couldn’t catch a pedophile sex trafficker who used email to coordinate all of his pedophile sex trafficking

That’s what my wife said too.

Also the cheesesteaks were from this place, so nobody was asking any more computer science questions after that point. www.instagram.com/reel/DEgHXwT...

Having a kid is the very best way to make yourself feel dumb.

The 18y/o asked me how LZW compression worked at dinner tonight and I was like “oh [vague stuff about building a dictionary]” and he was like yeah, obviously but how do they build the dictionary, and I realized for the 6627th time that I know 0.1% of computer science and then our cheesesteak came.