When Is a Proof Actually Not?

on YouTube ↗39m

" summary

Finds concrete forgeries: a flawed Pedersen key generation in SwissPost-Scytl-iVote mixing and decryption proofs lets someone who knows the discrete log open commitments arbitrarily, enabling undetectable fake shuffles (math worked out in hours, exploit coded in four days) and a Fiat–Shamir misuse lets a mixer fabricate decryption proofs; a Civitas plaintext equivalence instantiation lets colluding trustees force the test to return “equal” by zeroing randomness. Fixes: regenerate parameters securely, include all claim data in hashes, and reject the trivial (1,1) ciphertext.

AI-written summary · about

" chapters (19)

1. 0:00Intro
2. 0:22Sometimes something that looks like a proof actually isn't
3. 0:55The hidden (false) assumption can be subtle
4. 1:31Sometimes a cryptographic proof actually isn't
5. 2:55How not to prove your election outcome
6. 3:38Swiss complete verifiability
7. 7:441. The Shuffle Proof: Pedersen Commitments
8. 10:171. The Shuffle Proof: Commitment parameter generation
9. 12:061. The Shuffle Proof: Testing an exploit
10. 13:181. The Shuffle Proof: Fake proof
11. 14:231. The Shuffle Proof: Summary
12. 15:50Good thing they had some genuine independent review before using it
13. 16:46Doesn't NSW have a law mandating open public access to the source code?
14. 23:182. The Decryption Proof: The Weak Fiat-Shamir Heuristic: Implications
15. 25:062. The Decryption Proof: New South Wales iVote? iVote and Swiss Post
16. 27:40What about quality academic systems built by people who really knew what they were doing?
17. 29:04A subtle misalignment of assumptions in CJ
18. 32:03Plaintext Equivalence in the Civitas implementation of JCJ
19. 36:12Conclusion

" related talks

• 58mKeynote: Who cares about Democracy?A/Prof Vanessa Teague · linux.conf.au 2020
• 40mShuffling and FriendsTjerand Silde, Toomas Krips, Giuseppe Vitto · RSAC 2021
• 24mA Decade After Bleichenbacher '06, RSA Signature Forgery Still WorksSze Yiu Chau · Black Hat USA 2019
• 01h 09mProofs - Practice 1Justin Thaler · Cryptography 10 Years Later: Obfuscation, Proof Systems, and Secure Computation Boot Camp 2025
• 01h 15mTo interact or not to interact: Cryptographic proof systems and the Fiat-Shamir heuristicAlex Lombardi · Cryptography 10 Years Later: Obfuscation, Proof Systems, and Secure Computation Boot Camp 2025
• 51mWhy you shouldn't trust meKeerthana Ganesh, Shubham Patil · NDC Oslo 2022
• 57mThe Cryptographic Lens: Visions of our Past and FutureShafi Goldwasser · Symposium on Visions of the Theory of Computing 2013
• 01h 08mTutorial on Proof SystemsAbhishek Jain · Minimal Complexity Assumptions for Cryptography 2023