安全与密码学2024eprint.iacr.org
无需可信设置或公钥密码学的异步共识
Asynchronous Consensus Without Trusted Setup or Public-Key Cryptography
专业 · 约 80 分钟读完前置知识：分布式共识基础、密码学哈希函数、异步网络与故障模型
导读
这篇论文提出一种异步共识协议，不依赖可信初始化和公钥密码学，仅使用哈希函数等对称密码原语。由于只依赖哈希函数，该协议天然具备抗量子特性，避免了后量子公钥算法（如 SPHINCS+）签名/密钥过大的问题。
HN 关注点：不用公钥密码的共识协议是否真的有意义，以及对恶意节点/Sybil 攻击的安全性如何保证。
HN 评论精选
这几条评论里：质疑 2 补充 2
质疑质疑协议对恶意节点和 Sybil 攻击的防御阈值
还没细看，但我的第一个问题是针对恶意节点的安全性。所有这类协议，包括比特币，在足够高成本的 Sybil 攻击下都会失效。加密货币的诀窍是把攻击成本抬到需要经济上极不理性的攻击者。这篇论文的阈值是什么？
api查看英文原文
Haven’t had a chance to go through this but my instant #1 question is security against malicious nodes. All such protocols, even Bitcoin and friends, break under a sufficiently costly Sybil attack. The trick with cryptocurrency is to make the attack so expensive that it requires a highly economically irrational actor. What are the thresholds here?
补充指出仅用哈希函数意味着抗量子，且避免后量子算法开销大
该协议只用密码学哈希函数，因此是抗量子的。这一点重要是因为现有后量子公钥算法（如 SPHINCS+）的签名尺寸远大于 RSA 或 ECDH 等经典算法。（更正：SPHINCS+ 是签名而非密钥更大。）
steelframe查看英文原文
Their protocol only uses cryptographic hash functions, which means that it's post-quantum secure. One reason why this is significant is because existing post-quantum public key algorithms such as SPHINCS+ use much larger keys than classic public key algorithms such as RSA or ECDH. *Edit: As other have pointed out, for SPHINCS+ it's the signature size and not the key size that's significantly larger.
质疑批评论文是人为制造的任意限制，贡献被"混淆"夸大，更像综述
协议大致是：已有领导者 Dealer，构建 K-of-N 共享密钥集，发布参与者到密钥哈希的映射，分发密钥，参与者两两交换秘密，最终多数人获得共享密钥。但很多宣称并不成立："抗量子"在此无特殊价值，"最少使用密码学"与实用性无关，"无公钥加密"实际是把发送者身份验证外包给网络层，用方程组求解共享密钥也算密码学。整体贡献像是"人为设定一个新颖但任意的限制然后解决它"，对培养研究生和凑论文数有用，当作该领域的综述读还不错。
Rhapso查看英文原文
So the protocol seems to boil down to: 1) Already have a leader "Dealer" 2) The leader builds a K-of-N set of shared secret keys. 3) They publish a mapping of each participant (participant_i->hash(secret_i)) 4) The leader transmits each key to each participant 5) Participants exchange secrets pairwise, armed with the upfront mapping of participants->secrets 6) Select K and a k-of-N secret scheme such that a majority of participants now have a shared key lots of the claims aren't meaningful: - "post quantum" for example isn't a special value in this situation. - "minimal use of cryptography" isn't relevant to practicality - The "experimental" component doesn't meaningful contribute to the conclusion. - No public-key-encryption really means "outsource sender identification to the network layer" - They pretend using a system of equations to solve for a shared key isn't"cryptography". In general the contribution of the paper reads as "offusicated". The lack of "public key cryptography" sets them up for a novel problem to solve, but it is an arbitrary handicap that doesn't provide utility. This is academic "make up a novel and nontrivial problem and then solve it", its of utility to the process of producing grad students and publication count but not something we need to get excited about. Read it like a survey paper of the space, which it does well as.
补充联想到 Git 多人签名场景，询问真正的多重签名方案
我希望 Git 能有个功能，让多个人共同签署一个 PR 或提交。有没有一种多重签名方法不是"仅仅"对别人的签名再签名？
bloopernova查看英文原文
I kind of wish Git had a feature where multiple people could sign a PR or commit. Is there a multiple signature method that isn't "just" signing other people's signatures?
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2024Hacker News 讨论帖157 分 · 46 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选