Matt Blaze is a computer science professor who researches cryptography, security and surveillance, including lock vulnerabilities and wiretapping systems.
HN commenters recommend his papers on master-key locks, CALEA weaknesses and the Eavesdropper's Dilemma, calling the master key paper a classic and him an excellent researcher.
Really? Stable-coins as a concept have existed for years, and in practice have blown up in trading volume and circulation the past 2 years.
USDC stable-coin [0]($34 Billion in circulation) is arguably the most trustworthy in terms of having a 1 to 1 exchangeable backing through a regulated centralized custodian (Circle/Coinbase primarily but also BlockFi and other entities that hold USD reserves for exchange).
Many of these entities (as well as "DeFi" decentralized finance platforms that use Ethereum or similar smart contracts to decentralize the process) allow for various forms of deposit and lending accounts that provide a whole range of yields way way above traditional banking deposits. On top of this, some of these custodians add an additional layer of payment ability to these deposit accounts. Crypto.com[1] for example has a Visa debit card that ties into your USDC/stable coin deposits that you can transact from, in theory avoiding needing to use fiat at all. As well as "CD-like" 3-month lockups where you can get 8-12% yield.
There are also many decentralized stable coins that have various forms of over-collateralized crypto-asset reserves backing the coin and algorithms to stabilize the value by buying or selling from these reserves, trading off possible volatility and uncertainty around peg to avoid centralization and KYC and other regulations of 1:1 backed coins.[2]
[0] https://www.circle.com/en/usdc
[1] https://crypto.com/us/earn
[2] $MIM dollar stable-coin:…
If you think we are pretty good at encryption, I'm worried that you're not paying attention.
Matt Green captures the spirit of what a lot of us feel who are on the front lines of infosec defense:
https://twitter.com/matthew_d_green/status/709919895002042368
"We can barely encrypt."
This problem is not new. Put some time in and read Matt Blaze's paper "Why (Special Agent) Johnny (still) can't encrypt." http://www.crypto.com/papers/p25sec.pdf
>>Also, as far as 'showing you a way' ...
My point is apparently poorly made, so let me try improving. Encryption is a feature- but our ability to properly implement it is woefully inadequate. Many developers think very much like you seem to be- I have a secret, so I need to encrypt. But they forget about (or have no awareness of ) offensive methods for intercepting a secret with a debugger. They think in terms of network transport or file system objects.
So many a developer says "I'll just take out my copy of applied cryptography and go to work." And then security experts get more fuel for yelling about the danger of rolling your own crypto (even if you're just implementing what you see in Applied Crypto).
Finally- I was obviously not talking about conditional statements. Read it again and pay attention. Hypothetical "if only" scenarios are great and amusing way to burn brain cycles with no real application. It is also a tactical error, because it indulges people in considering things that don't exist as potentially…
I have a crypto.com account and, if other exchanges are like them, I swear the goal is to make it difficult to take money out of the system. I have a less popular coin that I mined (<$2k worth) and the ability to transfer my coins to crypto.com so I can cash out for real money has been "coming soon" for over 6 months.
Of course it's super easy to buy and there are no barriers in terms of cost if you want to bring money into the system, but even transferring out of the exchange to another crypto wallet is ridiculous. I bought some ETH hoping to try out ENS. At the time it was .008 ETH to transfer my money to a different ETH wallet. Now that's $35.
How is crypto revolutionary again? Would you stay with a bank that charged you $25 to transfer your money to another bank? And the icing on the cake? I just went to the crypto.com fee list [1] and I can't even figure out how much it costs to transfer ETH to ETH now. They changed the way it works so it's not obvious.
I think it needs to happen on a different chain or something. Who knows. Can anyone explain how it works? Can anyone explain how crypto currency is supposed to change the world if they can't even transfer my money around, for a reasonable price, with an easy to understand system?
1. https://crypto.com/exchange/document/fees-limits
> You can pretty much live off of bitcoin tbh. Or at least you can spend it in a lot of places.
> - https://www.bitrefill.com/
Buying gift cards is the same as cashing out but worse in every way. Pre-converting to a limited-use intermediate currency and then spending that intermediate currency isn't the same as spending bitcoin.
> - https://crypto.com/cards
I notice that their "stake" requirements are listed in USD, not CRO, and that this runs through both Visa and Metropolitan Commercial Bank to do centralized back-end conversions into and out of their bespoke coin. It sounds a lot like the blockchain aspect adds literally nothing to the equation and is just there to ride the buzzword FOMO zeitgeist.
> - https://foldapp.com/
Same as ^ but with a different centralized backend bank and a different bespoke coin that adds literally nothing to the equation.
Also, if you are interested in actual master keys, Matt Blaze's paper on the subject is a classic: http://www.crypto.com/masterkey.html
"n a recent research paper, we describe weaknesses in most master-keyed lock systems, such as those used by offices, schools, and businesses as well as by some residential facilities (particularly apartment complexes, dormitories, and condominiums). These weaknesses allow anyone with access to the key to a single lock to create easily the "master" key that opens every lock in the entire system. Creating such a key requires little skill, leaves behind no evidence, and does not entail engaging in recognizably suspicious behavior. The only materials required are a metal file and a small number of blank keys, which for many locks are readily available."
Matt Blaze developed a very cool attack against master-key lock systems: http://www.crypto.com/papers/mk.pdf
It requires access to one (non-master) key as well as a lock which is open-able by that key. It also requires being able to generate a modest number of new keys with a key cutter (however significantly fewer than brute forcing the entire space).
IIRC, the attack boils down to:
- Start with the known non-master key
- Hold all but one of the teeth constant, and try different values of that one tooth until you get a different working key. This other value must be the master key's value.
- Repeat until you have the master value for each tooth.
If TSA locks work the same way as the locks described in this paper, a single lock/key seems sufficient to generate the master key.