Ian Miers

CS Prof. Security and applied cryptography.
Some highlights: Zerocash (zcash, et al. ), Zexe (Aleo, Aztec, etc ), zk-creds/zk-promises(...)

[Ian Miers @secparam]

@odin_free Figures it got confused. But what's the privacy story for strk20 ?

[Ian Miers @secparam]

Are STARKs zk yet? In theory zk by blinding is easy. In practice, implementations didn't do it, leading a few of my colleagues to wonder about feasibility.
Claude tells me: "StarkWare has Shieldnet, a private payment pool, proven with Stwo. But I can't find the documentation for the zk part — no blinding parameters published, and their Lean verification work targets soundness."

[Ian Miers @secparam]

There's a long history of folks shilling privacy and zk when the schemes weren't zk. Someone even tried to trademark zk and they didn't have a zk scheme.
"Are STARKs zk yet?" popped into my head before I knew STARKware shipped stealthnet. I assume it got resolved before shipping

[Ian Miers @secparam]

What happens to Crypto/Eurocrypt when a proof of security becomes easy? Everyone's first instinct with AI papers is to raise standards, reject misformatted or technically incorrect papers. But it won't work forever. How do you define taste if those (poor) proxies are gone?

[mjos\dwez @mjos_crypto]

Eurocrypt 2027 received 1059 submissions, up 56% from last year (680). I'm not even sure what "review preferences" are supposed to mean with over 1000 submissions -- "I have familiarity with the subject matter of these, um, 300 papers..?"

[Ian Miers @secparam]

@badcryptobitch The vaguess was deliberate, there a number of things folks put under that umbrella. And it's a weird umbrella. A snark without trusted setup is ... A snark.

[Ian Miers @secparam]

Apple Reference Image is a good example of where you need nuance. When PCC breaks, Apple sees unedited images, which could expose journalists or sources. And they retain identity info for revocation. We need to be clear about those risks.
And then there's the treacherous computing angle
https://t.co/e5ks2gfAqf

[Tim Sweeney @TimSweeneyEpic]

@timsoret I hate that Apple is legitimizing Adobe's failed "content authenticity" DRM and surveillance initiative. Sounds nice until governments demand identifying information be added, and demand all images without the DRM be treated as suspect, and use it to further censor social media.

[Ian Miers @secparam]

On device and in-cloud trusted hardware is not perfectly secure or private. For some uses its great, for others catastrophic. For civil-society applications like Apple's Reference Image, we need to keep this in mind.
Calling it Private Cloud Compute hides the distinction.

[Tim Sweeney @TimSweeneyEpic]

@secparam It's super Orwellian to read professions adopting corporate marketing adjectives as if they're statements of fact: "trusted" hardware, "Private" Cloud Compute, "trusted" man-in-the-middle. The world has lost its senses on the underlying threat model. https://t.co/kQxBW00fyU

[Ian Miers @secparam]

@read_jfk_files As I understand it, this is opt-in. If we are clear about the risks, users, like journalists, can decide if its worth it.
Of course, there is the risk this becomes mandatory. I think this is small, for now. But it would be negligible if Apple had never built the system at all.

[John Scott-Railton @jsrailton]

“Who’s a good boy?!”

Hackers just dumped the contents of a Flock camera.

They found:

🔴Software explicitly detecting people, not just plates
🔴1.6 million images logged in 21 days
🔴Key to decrypt files stored on the device itself.

Finds directly contradict Flock, which claims someone with physical access can't access images.

Making it worse,@GainSec warned about the physical access issue more than a year ago & Flock downplayed it.

And yeah, the Flock camera logged “Who’s a good boy?!” about every 2 minutes, all while plagued with errors, crashes & reboots.

By @dmehro & @josephfcox
https://t.co/5a91FwVrPf

[Ian Miers @secparam]

**Trusted** man-in-the-middle was meant to highlight the contradiction. I probably should have put it in quotes.

I agree with you on the identifying information bit being a problem, particularly the revocation parts.

Ideally, we never have these systems. My worry is that we don't get to pick if we live in a world where we need them. There’s a decent chance no one trusts any photo, even with some provenance information or entry in some time stamp log.

[Ian Miers @secparam]

Apple's new "Reference Image" design suggests something Apple won't say out loud: they don't actually trust the iPhone's Secure Enclave that much. They're probably right, and that has implications both for other proposals to stop deepfakes and for privacy-preserving identity, if it ever gets beyond stopping kids from looking at porn.

Reference Image is a mode in the iPhone camera where Apple's servers sign a photo as genuine. The phone sends the raw data, signed by its trusted hardware, to Apple's Private Cloud Compute (PCC) servers, which process it, apply edits, and sign the result. It hides who took the photo, though Apple appears to keep identifying data so it can revoke photos from hacked phones.

But why involve Apple's servers at all? It costs money and adds risk for Apple, like demands to deanonymize journalists, so they really have to get Private Compute Right.

Maybe Apple couldn't get the image pipeline running inside the Secure Enclave. I doubt it. They could have, or could have with some work.

But iPhones get jailbroken, and keys can be extracted from the Secure Enclave. If your threat model includes nation states making deepfakes, assume they'll do it. So I think Apple is using PCC as a trusted man-in-the-middle: it sees everything, so it can try to block exploited devices, and adapt as they see what attackers do.

The other thing that relies on secure hardware is privacy-preserving credentials. Google's zk-id proposal uses hardware device binding to prevent credential sharing, and you might want to verify biometrics at enrollment too. But if we start using this for privacy-preserving KYC in banking and cryptocurrency, or for proof of personhood and deepfake prevention on social media, attackers will try to steal credentials or buy and borrow legit accounts. Device binding is meant to stop this. Apple's design suggests they think it can't.

[Ian Miers @secparam]

@colludingnode There is no such thing as Fully Homomorphic Decryption.

[Ian Miers @secparam]

@yo_yo_yo_jbo The design does seem solid aside from privacy concerns. "They don't trust their phones" was not meant as a criticism, but I think using PCC gets them more security than a purely on phone system would.

[Ian Miers @secparam]

@notdan @matthew_d_green Funny I heard the same thing

[Ian Miers @secparam]

@salt___doll Its a good call by apple, but I think there's more too it than it didn't work in the SE.
If it was just that, they wouldn't have added this: "Using a neural network with hidden weights, PCC computes a confidence score for the photograph."
https://t.co/rJH5hwB3U8

[Ian Miers @secparam]

@HexNom There server side TEEs for PCC and ones on the phone, the sep or secure enclave. And there's a very different level of security, since the phone is definitely attacker controlled

[Ian Miers @secparam]

@zkDragon @zkproofs Do you have more details on this somewhere? And just to be clear, you mean this kind of doubly efficient PIR? If so, thats amazing!!!!
https://t.co/lIrcyyNi3K

[Ian Miers @secparam]

Of course, there are cases where you have no choice: signature keys for transactions have to live somewhere
Then there are cases like key or identity escrow, where your claiming threshold cryptography mitigates very obvious downsides.

[Ian Miers @secparam]

Remember, if you say "threshold cryptography" 2 out of 3 times, it will keep the North Korean hackers away. Never mind that bridge they just hacked by stealing the keys for multiple distinct signing parties.

[Ian Miers @secparam]

I agree we should, but it gets complex fast. Lets say a regulator agrees to sanctions checks without record retention. In short order, you are going to have to deal with stolen/resold identity docs or money mules with legit docs. A static check, even daily, even with device binding, isn't enough.
Can you build a system that is? I hope so. We definitely need more work on these things. But the basic starting point is defining the research problem.