Shorter Koblitz

If you have similar interests to mine, you're probably wondering why all those crypto-theorists are so riled up about Neal Koblitz's latest piece in the AMS notices.

In hopes of sparing you all the hour I just wasted trying to read Neal's deathless prose, here is a short (or at least shorter) and likely rather biased summary of what he says.

Pages 972-974: A brief history of number-theoretic cryptography in the 1980s, in which Koblitz shows off his credentials as the inventor of elliptic curve cryptography. Cryptography used to be a form of rebellion against the fascist and corporatist system. Everyone loved everyone else and wore flowers in their hair.

Page 974: Someone invented an algorithm, but the theoretical worst-case analysis showed that it was too inefficient, which it turned out to be as well for practical problem sizes. Instead of seeing this as a success for theory, Koblitz somehow turns this into an example of worst-case analysis being wrongheaded and unhelpful.

Page 975: In the 1990s, more mathematicians wanted to start doing crypto, and that's bad because they weren't already experts and therefore shouldn't have even tried. More funding agencies wanted to fund crypto research, and that's also bad because it led people to become patriots.

Page 976: Cryptography conference have deadlines, and that's bad because authors get sloppy in the rush to meet the deadlines. If you can't write a stellar breakthrough paper, better not to write at all. But only a true mathematician can have been alive for the thousands of years necessary to understand this self-evident truth. Cryptography has been corrupted by impure influences of technology and corporatism and therefore cryptographers are too impatient and greedy. Mathematicians are large slow-moving mammals, cryptographers are quick-witted birds, and somehow that strained analogy implies that mathematicians are best.

Page 976: Koblitz whines that people resent him and wish he would go away.

Pages 976-977: Provable security is only as good as your attack model and hardness assumptions. (As everyone with even the slightest familiarity with crypto already knew.)

Page 977: Provable security is used to trick non-experts. (Probably also true, but there seems to be some intellectual dishonesty going on here: the people who are using claims of provable security to trick non-experts into buying their shoddy cryptosystems are, I think, largely not the same as the people who are publishing academic provable security papers, and he's tarring one group with the sins of the other.)

Pages 977-978: Proofs in cryptography are occasionally mistaken, and therefore we shouldn't trust any of them. Someone's paper bashing someone else's paper didn't get refereed by the people it was bashing, and would have been rejected if it had. Anyway, only true mathematicians should be allowed to use the word "proof" because it's too powerful to let loose among the hoi polloi. "Proof" means "skip this part because you won't understand it" and cryptographers shouldn't be allowed to let people skip things. Cryptographers should be forced to call their proofs "arguments" instead, and they should be allowed even that much only if they write in a way that is perfectly clear and understandable to non-experts.

Page 978: Asymptotic analysis is fallacious and absurd.

Page 978: Someone wanted to label Koblitz' editorial as an editorial. And he was a Jew.

Page 979: Everyone hates Koblitz, therefore he's right. Cryptographers are childish, but he enjoys fighting with them.

Comments: