7 ms·

Programmable Cryptography (2024)

87 points by fi-le 7mo ago

adrian_b 7mo ago
I do not give a * about programmable cryptography, because it is not something useful for individual users or for small/medium businesses. It is something that big companies hope to be able to use for providing services to customers that will move all their computing needs to clouds owned by others, instead of owning their computers. The cryptographic applications that are useful for individual users and for small/medium businesses remain the traditional ones, e.g. data encryption, data authentication, random number generation, strong one-way hash functions, password hashing schemes. None of the algorithms suitable for programmable cryptography can ever approach the efficiency of the classic cryptographic algorithms, simply because the requirements for the classic algorithms are much weaker. Thus, no matter how universal an algorithm for programmable cryptography might be, it will not be an acceptable substitute for any of the classic algorithms, whenever the additional requirements for programmable cryptography are not necessary.
- ozim 7mo ago
  The article reads exactly like written by a person who is much into the topic imagining use cases that are not there. It also reads like a junior dev or a student with „universal” having too much value in their own words.
snthpy 7mo ago
Thanks for the PSA. Sounds like some cool new developments I want to learn about.
miohtama 7mo ago
Zk would perfect for online age verification, but governments do not want to implement it like this. Instead they want id and face collection for mass surveillance, using age verification as an excuse.
- perching_aix 7mo ago
  For age verification and identity verification both afaik. Sometimes I wonder if what's needed is "just" a more public push for it, but these topics are so hopelessly technical, I think it has no hope to ever reach the mainstream and poll well. And that is ignoring all the other counterarguments against these that compound on top, some of which are culturally sensitive for many.
  - LelouBil 7mo ago
    I saw a presentation about this 6 months ago, it looked promising for age verification for example, it's even an already done system, not a research article. https://github.com/microsoft/crescent-credentials https://github.com/microsoft/crescent-credentials But of course the thing would need users in order to attract users.
  - hunterpayne 7mo ago
    These topics are political and I seriously doubt these types of solutions are what the politicians are looking for. In fact, they are the exact opposite of what they are looking for because it takes away the excuses they are using and would lay bare what they are actually trying to do. BTW, I'm not suicidal and I bet you aren't either.
- pullthatupjamie 7mo ago
  Based on recent revelations with certain "files" and brazen disregard for human life, I find it hard to believe that the "people" in the gov really care about children at all.
  - hinkley 7mo ago
    They care the way a cheetah cares about gazelles.
- j2kun 7mo ago
  Google is rolling out ZKP for age verification with state-issued digital IDs. See https://www.eff.org/deeplinks/2025/07/zero-knowledge-proofs-alone-are-not-digital-id-solution-protecting-user-privacy https://www.eff.org/deeplinks/2025/07/zero-knowledge-proofs-... for context
Retr0id 7mo ago
I agree that we have more capable+flexible cryptographic primitives than ever before, but I don't really buy the "Universal Protocol" thing. For non-cryptographic uses we have "universal protocols" already, JSON being an example. You can adapt just about any format to and from JSON, if you want. But the fact that this is possible has not solved the interop problem, in the general case. Similarly for "Hallucinated Servers". Even if you trust all nodes (and don't need cryptography), distributed computing is still kinda hard, and we have to write programs in particular ways to make them efficiently distributable. I'm sure this can work really well for some problem domains, but it's a subset.
- Uptrenda 7mo ago
  I think the idea is that if an API (or anything really) is using a flexible cryptographic model then it would be possible to string together any system for use in any cryptographic scheme. For example: you could write the cryptographic equivalent of "if user deposits $100 into this bank account then allow them to redeem these crypto-currencies" This would mean making systems broadly compatible. Anyone could envision new use-cases for pre-existing systems and be able to extend them without having to modify the existing system. But the challenge of this is (1) designing a simple, fast cryptographic stack (2) widespread adoption.
  - Retr0id 7mo ago
    > For example: you could write the cryptographic equivalent of "if user deposits $100 into this bank account then allow them to redeem these crypto-currencies" You can do this today.
    - Uptrenda 7mo ago
      Thanks for letting me know. I also worked on this in 2013.
pullthatupjamie 7mo ago
But won't this make the Palantir AI Overlord angery?
deleted 7mo ago
[deleted]
hunterpayne 7mo ago
Homomorphic encryption and similar techniques in this paper are just getting going. They are impressive technologies. However, they often take 100x the compute of "regular" systems with encrypted networking. This is probably the main blocker for these types of technologies. Until and unless insurance companies mandate these technologies because they are tired of paying out for their customers getting hacked, they probably won't be deployed. Probably for the best. Most devs can barely make code without advanced math and encrypted data work, let alone these types of advanced platforms.
cyberax 7mo ago
I've been looking at the field, and I can't really see how most of this is useful. ZKPs and FHE add a lot of complexity to a pretty simple task: verifying the age and/or identity. These tasks are so simple that you can _almost_ use the existing TLS client certificates for that. Their only drawback is that they're trackable. A simple asymmetric challenge-response system with a nonce easily fixes this: 1. The service provider generates a 128-bit nonce and sends it to me. 2. I use a verification system provided by my government, and it returns a document saying: "The owner is more than 18 years old, the nonce for the request was ......, and this proof is valid for this service name hash". This document is signed by the trusted government certificate. 3. I send this signed document to the service provider. No need for range proofs and other stuff. I think this flow can even be expressed using OIDC and JWTs! What am I missing that requires full-blown ZKPs?
- tripplyons 7mo ago
  To answer your question, ZKPs can enable the verification step to be done privately in your example. Another use case could be allowing cloud computing hosts to prove that they did not tamper with the results of a computation.
  - cyberax 7mo ago
    In this case, the government service doesn't get to know anything about the service (it only gets to see the salted hash of the service name)? And the service doesn't get to know anything about me, except for the "age certificate". You can add more layers there, if needed for non-repudiation, all within the bounds of classic asymmetric crypto. > Another use case could be allowing cloud computing hosts to prove that they did not tamper with the results of a computation. What is the exact scenario here?
    - saltpath 6mo ago
      The concrete scenario is AI agent execution. Agent calls a third-party API at 3am — you have your logs, they have theirs, and if there's a dispute you're comparing two mutable records. Sealing both the request hash and response hash with an RFC 3161 timestamp before the agent proceeds gives you a neutral third-party witness. Not zero-knowledge — content is visible — but for audit and dispute resolution it covers 90% of real cases and is deployable today without ZKP overhead.
DonsDiscountGas 7mo ago
I really liked reading this but I imagine the impact will be a lot less than the author is imagining. Current encryption methods are pretty good to the point where privacy beaches are always social engineering or stolen laptop or something dumb like that
tripplyons 7mo ago
As much as I like the ideas, this article looks AI generated. This line with the bullet point, bolded label and colon, em-dash, and the second clause "it's about" all point to AI writing. "Fiber-optic cables: Fiber-optic cables enable higher bandwidth phone lines and television—it’s about getting more television channels to more people."
- Retr0id 7mo ago
  That part in particular is suspect and I wouldn't be surprised if it was AI-assisted, but the article as a whole feels human-written to me.
- tern 7mo ago
  I know I'm just adding to the noise here, but it seems like half the time I look at comments on posts (anywhere) I see a claim like this. I think you're probably just trying to warn people so they don't waste their time, but for me this type of comment is not helpful at all.
Uptrenda 7mo ago
Most of the crypto in the OP requires trusted setup phases and is too slow to use for any kind of general-purpose computation. It's the reason why most cryptographic protocols consist of simpler schemes and don't try to do everything. This article is click bait though. Feel like OP just stumbled upon what people have been doing for the past 5 years and wrote this half-baked article on it.
- sali0 7mo ago
  This was true 3 years ago but not generally the case anymore. There's been significant advancements to move away from trusted setups and the speedups with current methods are quickly approaching viability.
  - Uptrenda 7mo ago
    List some
- tern 7mo ago
  0xparc is a research lab. They may be wrong or mislead, but they work on this stuff every day—it's not some guy stumbling across something.
  - ozim 7mo ago
    If they are research labs then this article feels like was written by junior researcher they just hired and he is so pumped. But this stuff is not going to replace current state of things as article claims.
  - Uptrenda 7mo ago
    Where are their novel papers?
IAmLiterallyAB 7mo ago
Citation needed. We don't even know if indistinguishability obfuscation is possible.
- aruss 7mo ago
  This changed in 2020! Indistinguishability Obfuscation from Well-Founded Assumptions: https://eprint.iacr.org/2020/1003.pdf https://eprint.iacr.org/2020/1003.pdf

87 points by fi-le 7mo ago

I do not give a * about programmable cryptography, because it is not something useful for individual users or for small/medium businesses. It is something that big companies hope to be able to use for providing services to customers that will move all their computing needs to clouds owned by others, instead of owning their computers. The cryptographic applications that are useful for individual users and for small/medium businesses remain the traditional ones, e.g. data encryption, data authentication, random number generation, strong one-way hash functions, password hashing schemes. None of the algorithms suitable for programmable cryptography can ever approach the efficiency of the classic cryptographic algorithms, simply because the requirements for the classic algorithms are much weaker. Thus, no matter how universal an algorithm for programmable cryptography might be, it will not be an acceptable substitute for any of the classic algorithms, whenever the additional requirements for programmable cryptography are not necessary.

ozim 7mo ago
The article reads exactly like written by a person who is much into the topic imagining use cases that are not there. It also reads like a junior dev or a student with „universal” having too much value in their own words.

snthpy 7mo ago

Thanks for the PSA. Sounds like some cool new developments I want to learn about.

miohtama 7mo ago

Zk would perfect for online age verification, but governments do not want to implement it like this. Instead they want id and face collection for mass surveillance, using age verification as an excuse.

perching_aix 7mo ago
For age verification and identity verification both afaik. Sometimes I wonder if what's needed is "just" a more public push for it, but these topics are so hopelessly technical, I think it has no hope to ever reach the mainstream and poll well. And that is ignoring all the other counterarguments against these that compound on top, some of which are culturally sensitive for many.
- LelouBil 7mo ago
  I saw a presentation about this 6 months ago, it looked promising for age verification for example, it's even an already done system, not a research article. https://github.com/microsoft/crescent-credentials https://github.com/microsoft/crescent-credentials But of course the thing would need users in order to attract users.
- hunterpayne 7mo ago
  These topics are political and I seriously doubt these types of solutions are what the politicians are looking for. In fact, they are the exact opposite of what they are looking for because it takes away the excuses they are using and would lay bare what they are actually trying to do. BTW, I'm not suicidal and I bet you aren't either.
pullthatupjamie 7mo ago
Based on recent revelations with certain "files" and brazen disregard for human life, I find it hard to believe that the "people" in the gov really care about children at all.
- hinkley 7mo ago
  They care the way a cheetah cares about gazelles.
j2kun 7mo ago
Google is rolling out ZKP for age verification with state-issued digital IDs. See https://www.eff.org/deeplinks/2025/07/zero-knowledge-proofs-alone-are-not-digital-id-solution-protecting-user-privacy https://www.eff.org/deeplinks/2025/07/zero-knowledge-proofs-... for context

Retr0id 7mo ago

I agree that we have more capable+flexible cryptographic primitives than ever before, but I don't really buy the "Universal Protocol" thing. For non-cryptographic uses we have "universal protocols" already, JSON being an example. You can adapt just about any format to and from JSON, if you want. But the fact that this is possible has not solved the interop problem, in the general case. Similarly for "Hallucinated Servers". Even if you trust all nodes (and don't need cryptography), distributed computing is still kinda hard, and we have to write programs in particular ways to make them efficiently distributable. I'm sure this can work really well for some problem domains, but it's a subset.

Uptrenda 7mo ago
I think the idea is that if an API (or anything really) is using a flexible cryptographic model then it would be possible to string together any system for use in any cryptographic scheme. For example: you could write the cryptographic equivalent of "if user deposits $100 into this bank account then allow them to redeem these crypto-currencies" This would mean making systems broadly compatible. Anyone could envision new use-cases for pre-existing systems and be able to extend them without having to modify the existing system. But the challenge of this is (1) designing a simple, fast cryptographic stack (2) widespread adoption.
- Retr0id 7mo ago
  > For example: you could write the cryptographic equivalent of "if user deposits $100 into this bank account then allow them to redeem these crypto-currencies" You can do this today.
  - Uptrenda 7mo ago
    Thanks for letting me know. I also worked on this in 2013.

pullthatupjamie 7mo ago

But won't this make the Palantir AI Overlord angery?

deleted 7mo ago

[deleted]

hunterpayne 7mo ago

Homomorphic encryption and similar techniques in this paper are just getting going. They are impressive technologies. However, they often take 100x the compute of "regular" systems with encrypted networking. This is probably the main blocker for these types of technologies. Until and unless insurance companies mandate these technologies because they are tired of paying out for their customers getting hacked, they probably won't be deployed. Probably for the best. Most devs can barely make code without advanced math and encrypted data work, let alone these types of advanced platforms.

cyberax 7mo ago

I've been looking at the field, and I can't really see how most of this is useful. ZKPs and FHE add a lot of complexity to a pretty simple task: verifying the age and/or identity. These tasks are so simple that you can _almost_ use the existing TLS client certificates for that. Their only drawback is that they're trackable. A simple asymmetric challenge-response system with a nonce easily fixes this: 1. The service provider generates a 128-bit nonce and sends it to me. 2. I use a verification system provided by my government, and it returns a document saying: "The owner is more than 18 years old, the nonce for the request was ......, and this proof is valid for this service name hash". This document is signed by the trusted government certificate. 3. I send this signed document to the service provider. No need for range proofs and other stuff. I think this flow can even be expressed using OIDC and JWTs! What am I missing that requires full-blown ZKPs?

tripplyons 7mo ago
To answer your question, ZKPs can enable the verification step to be done privately in your example. Another use case could be allowing cloud computing hosts to prove that they did not tamper with the results of a computation.
- cyberax 7mo ago
  In this case, the government service doesn't get to know anything about the service (it only gets to see the salted hash of the service name)? And the service doesn't get to know anything about me, except for the "age certificate". You can add more layers there, if needed for non-repudiation, all within the bounds of classic asymmetric crypto. > Another use case could be allowing cloud computing hosts to prove that they did not tamper with the results of a computation. What is the exact scenario here?
  - saltpath 6mo ago
    The concrete scenario is AI agent execution. Agent calls a third-party API at 3am — you have your logs, they have theirs, and if there's a dispute you're comparing two mutable records. Sealing both the request hash and response hash with an RFC 3161 timestamp before the agent proceeds gives you a neutral third-party witness. Not zero-knowledge — content is visible — but for audit and dispute resolution it covers 90% of real cases and is deployable today without ZKP overhead.

DonsDiscountGas 7mo ago

I really liked reading this but I imagine the impact will be a lot less than the author is imagining. Current encryption methods are pretty good to the point where privacy beaches are always social engineering or stolen laptop or something dumb like that

tripplyons 7mo ago

As much as I like the ideas, this article looks AI generated. This line with the bullet point, bolded label and colon, em-dash, and the second clause "it's about" all point to AI writing. "Fiber-optic cables: Fiber-optic cables enable higher bandwidth phone lines and television—it’s about getting more television channels to more people."

Retr0id 7mo ago
That part in particular is suspect and I wouldn't be surprised if it was AI-assisted, but the article as a whole feels human-written to me.
tern 7mo ago
I know I'm just adding to the noise here, but it seems like half the time I look at comments on posts (anywhere) I see a claim like this. I think you're probably just trying to warn people so they don't waste their time, but for me this type of comment is not helpful at all.

Uptrenda 7mo ago

Most of the crypto in the OP requires trusted setup phases and is too slow to use for any kind of general-purpose computation. It's the reason why most cryptographic protocols consist of simpler schemes and don't try to do everything. This article is click bait though. Feel like OP just stumbled upon what people have been doing for the past 5 years and wrote this half-baked article on it.

sali0 7mo ago
This was true 3 years ago but not generally the case anymore. There's been significant advancements to move away from trusted setups and the speedups with current methods are quickly approaching viability.
- Uptrenda 7mo ago
  List some
tern 7mo ago
0xparc is a research lab. They may be wrong or mislead, but they work on this stuff every day—it's not some guy stumbling across something.
- ozim 7mo ago
  If they are research labs then this article feels like was written by junior researcher they just hired and he is so pumped. But this stuff is not going to replace current state of things as article claims.
- Uptrenda 7mo ago
  Where are their novel papers?

IAmLiterallyAB 7mo ago

Citation needed. We don't even know if indistinguishability obfuscation is possible.

aruss 7mo ago
This changed in 2020! Indistinguishability Obfuscation from Well-Founded Assumptions: https://eprint.iacr.org/2020/1003.pdf https://eprint.iacr.org/2020/1003.pdf