Cryptographers' Panel

Cryptographers' Panel

Speakers: Adi Shamir, Tull Rabin, Craig Gentry, Debbie Taylor Moore

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=pm6RabW2bA

Overview

This RSAC 2024 Cryptographers' Panel brought together leading minds in cryptography to discuss the most pressing and rapidly evolving challenges facing the security landscape today. Moderated by an honorary fellow from King's College, the discussion spanned critical topics including the urgent transition to post-quantum cryptography (PQC), the multifaceted security implications of artificial intelligence (AI), and the ever-present risks within the open-source software supply chain. The panel offered a high-level yet incisive analysis of the current state of cryptographic research, the practicalities of implementation, and the strategic decisions organizations must make to secure their digital future.

The session was particularly notable for its real-time discussion of a recent "drama" in the PQC community—a purported breakthrough that briefly threatened to undermine lattice-based cryptography, a cornerstone of NIST's chosen PQC candidates. This incident served as a vivid case study for the panelists to explore the scientific rigor, collaborative spirit, and inherent uncertainties in cryptographic research. Beyond quantum threats, the panel delved into AI's dual role as both a powerful tool for defenders and a new vector for sophisticated attacks, alongside a cautionary tale from the open-source world that underscored the fragility of software dependencies.

The insights shared by Adi Shamir, Tull Rabin, Craig Gentry, and Debbie Taylor Moore highlighted the dynamic interplay between theoretical advancements, practical engineering challenges, and public policy considerations in cybersecurity. Their collective expertise provided a comprehensive overview of the current threat landscape, offering strategic guidance for organizations grappling with complex security migrations and emerging technological risks. The panel emphasized a call to action for proactive engagement, continuous research, and a clear-eyed approach to managing risk in an era of unprecedented technological change.

Background

▶ Watch: NIST/NSA declare quantum threat, new standards (1:15)

The security community finds itself at a pivotal juncture, primarily driven by two monumental shifts: the impending threat of quantum computing to classical cryptography and the explosive growth and weaponization potential of artificial intelligence. For decades, the security of digital communications and data rested heavily on public-key cryptosystems like RSA and elliptic curve cryptography (ECC). These systems derive their strength from the computational intractability of certain mathematical problems for classical computers, such as integer factorization for RSA and the discrete logarithm problem for ECC.

However, the theoretical advent of powerful quantum computers, capable of executing algorithms like Shor's algorithm (introduced in 1994), poses an existential threat to these foundational cryptographic primitives. Shor's algorithm can efficiently solve the problems underpinning RSA and ECC, rendering them insecure. Recognizing this imminent threat, bodies like the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) have initiated efforts to standardize new cryptographic algorithms, known as post-quantum cryptography (PQC), that are believed to resist quantum attacks. The primary candidates for PQC are often based on lattice problems, which are conjectured to remain hard even for quantum computers. This migration is not merely a technical upgrade but a massive engineering and logistical undertaking, akin to Y2K or the transition to IPv6, but with far greater implications for long-term data confidentiality.

Concurrently, the rapid evolution of artificial intelligence (AI), particularly generative AI, has introduced a new layer of complexity. While AI offers unprecedented opportunities for automating threat detection, vulnerability analysis, and incident response, it also presents novel attack surfaces and tools for adversaries. The security community is grappling with securing AI systems themselves, using AI effectively for defense, and mitigating the risks of AI being weaponized. This multifaceted challenge necessitates a rethinking of traditional security models to encompass data integrity, model provenance, and the ethical implications of autonomous systems.

Finally, the increasing reliance on open-source software across all layers of the technology stack introduces inherent supply chain risks. While open source fosters collaboration and innovation, the distributed and often volunteer-driven nature of its development can create vulnerabilities. A single compromised component or a subtle backdoor can propagate across millions of systems, as demonstrated by recent high-profile incidents. The panel’s discussion on these themes underscores the urgent need for robust security postures that account for both theoretical cryptographic resilience and practical operational realities.

Key Findings

▶ Watch: Community quickly finds critical flaw in attack paper (2:15)

The panel discussion brought to light several critical findings and observations across the domains of post-quantum cryptography, AI security, and supply chain integrity:

1. The Lattice-Based Crypto "Near-Miss": A major drama unfolded in the PQC community just weeks before the conference. On April 10th, a 63-page paper by a young researcher from a Beijing university claimed a polynomial-time solution to the shortest vector problem (SVP) in lattices, up to a small gap, using a quantum computer. If valid, this result would have shattered the security foundations of lattice-based cryptography, including fully homomorphic encryption (FHE) and many of NIST's PQC candidates, leading to a "major disaster." However, the global cryptographic community mobilized swiftly, and within about a week, a critical flaw was identified on page 37 of the paper by researchers like Thomas from the Weizmann Institute and others from Berkeley. While the jury is still out on whether the bug can be fixed, the immediate threat to lattice-based crypto was averted, highlighting the crucial role of rapid, collaborative peer review in cryptography.

1. PQC Migration Strategy: Hybrid Solutions and Time Sensitivity: Despite the near-miss, NIST and NSA have not altered their PQC migration timelines. Tull Rabin emphasized that for organizations interacting with national security systems, continuing PQC development and implementation is essential. A significant development in this regard is the adoption of hybrid solutions for protocols like TLS. This approach combines a classical key exchange (e.g., RSA or ECC) with a post-quantum key exchange (one of the NIST candidates). This strategy provides a "buffer time" for new PQC assumptions to gain "street cred" and offers a fallback in case PQC algorithms are later found to be vulnerable, providing a crucial layer of redundancy.

1. Distinct PQC Considerations for Encryption vs. Signatures: Rabin also highlighted a critical distinction between encryption and signatures in a post-quantum context. Non-post-quantum signatures can be revoked once quantum computers emerge, limiting their future impact. However, encrypted data stored today using classical algorithms could be retroactively decrypted by a future quantum computer. This implies that the urgency for PQC migration is higher for confidentiality (encryption of long-lived secrets) than for authentication (signatures), as authentication systems generally don't have the same time sensitivity for post-compromise exploitation. Organizations must factor this into their PQC strategy.

1. AI Security: The Three-Pronged Challenge: Debbie Taylor Moore articulated the "three jobs" for security professionals in the age of generative AI:

• Securing internal AI implementations: Protecting an organization's own AI models and data from harm and ensuring they don't harm customers.
• Optimizing security operations with AI: Leveraging AI to enhance threat detection, response, and overall security posture.
• Defending against weaponized AI: Understanding and mitigating the risks posed by adversaries using AI for sophisticated attacks (e.g., automated phishing, malware generation).

This framework underscores the comprehensive nature of AI security, moving beyond traditional infrastructure protection to encompass data, analytics, and model intent.

1. Vulnerability of Proprietary AI Models to Parameter Extraction: Adi Shamir announced a groundbreaking finding, soon to be presented at Eurocrypt, demonstrating a polynomial-time algorithm to recover the internal parameters (weights) of a deep neural network. This attack requires only polynomial-many queries to the black-box model and observing its outputs, polynomial in the number of neurons. This implies that companies spending billions on training proprietary models, then allowing public interaction, are at significant risk of having their intellectual property extracted. The finding highlights the dangers of exposing AI models without "extra precautions."

1. Open-Source Deep Neural Networks and Supply Chain Risks: The panel drew parallels between traditional open-source software risks and emerging risks in open-source deep neural networks. While open-source software benefits from "many eyeballs" for bug detection (as evidenced by the XZ Utils incident), open-source deep neural networks, consisting of billions of parameters (numbers), lack this transparency. It becomes virtually impossible for human reviewers to detect subtle backdoors or malicious modifications within such a vast numerical dataset, posing a new and complex supply chain challenge for AI models.

These findings collectively paint a picture of a cybersecurity landscape undergoing profound transformation, where cryptographic foundations are being re-evaluated, AI is reshaping both offense and defense, and the integrity of digital supply chains remains a critical concern.

Technical Deep Dive

▶ Watch: Scientific path: continuous examination of new assumptions (2:55)

The panel's discussion provided a technical exploration of several cutting-edge areas in cybersecurity, offering insights into the underlying mechanisms and challenges.

Post-Quantum Cryptography and Lattice-Based Systems

The core of the PQC discussion revolved around lattice-based cryptography. These systems derive their security from the presumed difficulty of certain problems in high-dimensional lattices, such as the shortest vector problem (SVP) or the closest vector problem (CVP). Unlike RSA and ECC, which rely on number theory problems vulnerable to Shor's algorithm, lattice problems are believed to be intractable for both classical and quantum computers. This makes them prime candidates for NIST's PQC standardization effort.

The recent "drama" concerning the Chinese researcher's paper directly challenged this foundational assumption. The paper, a 63-page dense mathematical treatise, claimed a quantum algorithm capable of solving SVP up to a small approximation factor in polynomial time. A polynomial-time algorithm implies that the time taken to solve the problem grows as a polynomial function of the input size, making it feasible for large inputs—a critical threat to cryptographic security. The rapid response from the global cryptographic community involved intense scrutiny of the mathematical proofs and algorithmic constructions. The flaw, ultimately found on page 37, indicated a breakdown in the proof's logic or a critical assumption that did not hold, preventing the algorithm from achieving the claimed polynomial-time complexity for cryptographically relevant parameters. This incident underscores the extreme complexity and the rigorous peer-review process inherent in validating new cryptographic claims.

Hybrid Post-Quantum TLS

The decision by TLS (Transport Layer Security) to adopt a hybrid solution for post-quantum key exchange is a significant technical maneuver. In a hybrid TLS handshake, the client and server perform two independent key exchanges: one using a traditional, well-established classical algorithm (e.g., ECDH for Elliptic Curve Diffie-Hellman) and another using a new PQC algorithm (one of the NIST candidates, such as Kyber for key encapsulation). The final session key is then derived by combining the secrets generated from both key exchanges, typically through a cryptographically secure hash function. For instance, SessionKey = KDF(Classical_Secret || PQC_Secret).

This approach offers several advantages:

1. Backward Compatibility: It ensures that if the PQC algorithm turns out to be broken or has unforeseen vulnerabilities, the connection remains secured by the classical algorithm.
2. Increased Confidence: It allows the PQC algorithms to gain "street grade" experience and confidence in real-world deployments without immediately abandoning decades of proven classical security.
3. Risk Mitigation: It hedges against the unknown, acknowledging the possibility that current PQC candidates might not be as quantum-resistant as hoped.

Encryption vs. Signatures in a Quantum World

Tull Rabin highlighted a crucial distinction in PQC migration strategies:

• Signatures: Digital signatures provide authentication and integrity. If a classical signing key (e.g., RSA or ECC-based) is compromised by a quantum computer in the future, new signatures generated with that key could be forged. However, the impact is generally limited to future operations. Old signatures, once verified, might become unverifiable or forgeable in a quantum future, but immediate damage to past authentications is less severe if the key can be promptly revoked. The critical aspect is the inability to retroactively forge signatures from the past without access to the original signing process.
• Encryption: Encryption provides confidentiality. If data encrypted today with a classical public-key algorithm (e.g., RSA-OAEP, ECC-KEM) is intercepted and stored by an adversary ("store now, decrypt later"), a future quantum computer could decrypt it. This poses a significant threat to forward secrecy and the long-term confidentiality of sensitive data. Therefore, the urgency to transition long-lived encrypted data to PQC is much higher than for signatures. Organizations must prioritize securing data that needs to remain confidential for decades.

AI Model Security and Parameter Extraction

Adi Shamir's upcoming Eurocrypt paper unveils a significant threat to proprietary AI models. The research demonstrates a polynomial-time algorithm capable of extracting the weights (internal parameters) of a deep neural network by making a polynomial number of queries to the model's black-box API. This means that if a company trains a sophisticated AI model (e.g., a classifier or a large language model) and then offers it as a service where users can input data and receive outputs, an attacker could potentially reconstruct the entire internal architecture and parameter set of that model.

The attack leverages the input-output relationship of the neural network. By carefully crafting inputs and observing the corresponding outputs, the algorithm can infer the values of the weights. The "polynomial in the number of neurons" aspect indicates that even for large networks, the attack remains computationally feasible. This finding has profound implications for intellectual property protection and highlights the need for model obfuscation, access control, and potentially homomorphic encryption or secure multi-party computation techniques when deploying proprietary AI models.

Open-Source Supply Chain Risks: The XZ Utils Backdoor

The discussion brought up the XZ Utils backdoor as a contemporary example of open-source supply chain compromise. This incident involved a sophisticated attack where malicious code was subtly injected into the xz compression utility, a widely used component in Linux distributions. The backdoor was designed to allow unauthorized remote access via SSH. The ingenuity of the attack lay in its stealth and the way it exploited the trust model of open-source projects, with malicious actors offering to "help" maintain a package and gradually introducing the exploit.

The detection of the XZ Utils backdoor was a stroke of luck, found by a developer who noticed small timing differences in the software's performance, indicating unusual CPU usage during SSH authentication. This incident served as a stark reminder of the challenges in securing open-source dependencies, where even widely used and seemingly benign utilities can harbor sophisticated threats.

The panel extended this concern to open-source deep neural networks. Unlike traditional software where "many eyeballs" can review source code, a deep neural network's "source code" is effectively its billions of numerical parameters (weights). Reviewing these parameters for a subtle backdoor or malicious behavior is practically impossible for humans. This lack of transparency in open-source AI models creates a new, unaddressable layer of supply chain risk, where trust in the model's integrity becomes paramount but difficult to verify.

Demo / Proof of Concept

▶ Watch: Practical advice: implementing hybrid post-quantum solutions (3:50)

The panel discussion, by its nature, did not include live demonstrations or interactive proofs of concept. However, the technical discussions themselves served to highlight the theoretical and practical implications of the concepts discussed.

Notably, Adi Shamir's mention of his upcoming paper at Eurocrypt, detailing a polynomial-time algorithm to extract weights from black-box AI models, serves as a theoretical proof of concept for a significant vulnerability. While not a live demo, the academic publication of such an algorithm provides the blueprint for a practical attack, demonstrating that the threat of intellectual property theft from exposed AI models is not merely speculative but mathematically provable. The XZ Utils incident, though not a panel demonstration, functions as a real-world proof of concept for the dangers of open-source supply chain attacks and the subtle ways they can be introduced and detected.

Defensive Implications

▶ Watch: Strategic difference: encryption vs. signatures for quantum (4:05)

The insights from the Cryptographers' Panel offer critical guidance for security practitioners and organizations navigating the evolving threat landscape:

1. Accelerate Post-Quantum Cryptography (PQC) Migration Planning: Despite the "near-miss" with lattice-based crypto, the NIST/NSA push for PQC is unwavering. Organizations must continue to develop and implement PQC migration plans, especially those involved with national security systems or protecting data with long-term confidentiality requirements (e.g., 10+ years). C-suite awareness and pressure will increase once NIST releases its final PQC standards later this summer.
2. Adopt Hybrid PQC Solutions: For immediate PQC deployment, especially in protocols like TLS, prioritize hybrid solutions. This approach, combining classical and post-quantum key exchanges, provides a robust defense-in-depth strategy, mitigating risks from potential future breaks in PQC candidates while still preparing for the quantum threat. It buys critical time for new PQC algorithms to mature and gain confidence.
3. Differentiate PQC Strategy for Encryption vs. Signatures: Recognize the distinct time sensitivities. Prioritize PQC for encryption of data that requires long-term confidentiality, as this data is vulnerable to "store now, decrypt later" attacks. For signatures, while PQC is still necessary, the ability to revoke keys means the immediate threat to past authentications is generally lower, allowing for potentially longer migration timelines.
4. Conduct Comprehensive Crypto Inventory and Achieve Crypto Agility: Organizations must have a clear understanding of their entire cryptographic inventory, identifying all instances of RSA, ECC, and other classical algorithms. This includes dependencies within third-party components. The goal is to achieve crypto agility, the ability to rapidly swap out cryptographic primitives as new threats emerge or new standards are adopted. This is crucial for managing the complexity of deprecating old schemes, as seen with MD5 and SHA-1.
5. Develop a Holistic AI Security Strategy: Security professionals must embrace their expanded role in AI security. This involves:

• Securing internal AI: Implementing robust security controls around AI models, training data, and inference pipelines to prevent data poisoning, model evasion, and intellectual property theft.
• Leveraging AI for defense: Exploring and deploying AI-powered security tools for threat detection, vulnerability management, and automated response.
• Defending against weaponized AI: Proactively researching and developing countermeasures against AI-driven attacks, such as automated social engineering, advanced malware, and deepfakes.

1. Protect Proprietary AI Models: If deploying proprietary AI models as black-box services, implement "extra precautions" to prevent parameter extraction attacks. This could involve rate limiting queries, adding noise to outputs, using federated learning or confidential computing environments, or exploring zero-knowledge proofs to attest to model properties without revealing internals.
2. Enhance Open-Source Software Supply Chain Security: The XZ Utils incident is a stark reminder of the fragility of the open-source supply chain. Organizations must:

• Implement rigorous software supply chain security practices, including Software Bill of Materials (SBOMs).
• Increase scrutiny of critical open-source dependencies, especially those with limited maintainer support or sudden changes.
• Invest in automated tools for dependency scanning and integrity verification.

1. Be Wary of Open-Source Deep Neural Networks: Exercise extreme caution when using open-source deep neural networks. The "many eyeballs" principle that helps secure open-source software does not apply to billions of numerical parameters. Organizations must carefully vet the provenance, training data, and development practices of any open-source AI model they integrate, as detecting subtle backdoors is practically impossible.
2. Re-evaluate Long-Term Secret Protection: For secrets requiring protection for 100 years or more, public-key cryptography (even PQC) might not be sufficient due to the inherent uncertainty of future cryptanalytic breakthroughs. In such extreme cases, relying on symmetric-key cryptography with robust key management (potentially involving physical key distribution for ultimate assurance) might be the most prudent approach for highly sensitive, isolated systems.

Key Takeaways

• The transition to post-quantum cryptography (PQC) is urgent and non-negotiable, driven by the existential threat of quantum computers to current RSA and ECC.
• The hybrid approach for PQC deployment, combining classical and quantum-resistant algorithms (e.g., in TLS), is a pragmatic strategy to mitigate risk and allow new PQC candidates to mature.
• Organizations must differentiate between encryption and signatures in their PQC strategy, prioritizing migration for long-lived encrypted data due to the "store now, decrypt later" threat.
• AI security is a multi-faceted challenge, requiring organizations to secure their own AI, leverage AI for defense, and protect against weaponized AI.
• Proprietary AI models exposed as black-box services are vulnerable to parameter extraction attacks, threatening intellectual property and requiring "extra precautions."
• The open-source supply chain remains a critical vulnerability, with incidents like XZ Utils highlighting the need for vigilance, and a new, unaddressable risk emerging from the lack of transparency in open-source deep neural networks.

About the Speaker(s)

The panel featured a distinguished group of cryptographers and security experts, each contributing unique perspectives from academia, industry, and public policy:

• Adi Shamir: A renowned cryptographer, co-inventor of the RSA algorithm, and a recipient of the Turing Award. Shamir's contributions have fundamentally shaped modern cryptography, and his insights often touch upon the theoretical limits and practical vulnerabilities of cryptographic systems. He highlighted the "near-miss" in lattice-based cryptography and presented his new research on AI model parameter extraction.
• Tull Rabin: A recipient of the RSA Conference Mathematics Award, Rabin has a deep history in cryptography, having been head of the IBM crypto group at IBM Watson, which dates back to the creation of the Data Encryption Standard (DES). She is currently with AWS and on leave from the University of Pennsylvania, where she is a professor of computer science. Rabin provided practical guidance on PQC migration, hybrid solutions, and the distinction between encryption and signatures.
• Craig Gentry: Credited with creating fully homomorphic encryption (FHE), one of the "greatest jewels in cryptography since RSA." Gentry's pioneering work allows computations on encrypted data without decrypting it, a breakthrough with immense implications for privacy-preserving AI and cloud computing. He offered a contrarian, yet reassuring, view on the lattice-based crypto incident, emphasizing the inherent nature of cryptographic assumptions.
• Debbie Taylor Moore: A Vice President at IBM, invited for her expertise in AI, though she also possesses broad knowledge in crypto and public policy. Moore focused on the practical and strategic implications of AI for security professionals, outlining the "three jobs" of securing AI, using AI for security, and defending against AI weaponization. Her perspective bridged technical challenges with organizational and policy considerations.

The panel was moderated by an honorary fellow from King's College, who has hosted the Cryptographers' Panel since the conference's inception, providing historical context and guiding the discussion. The collective expertise of these speakers offered a comprehensive and authoritative overview of the most critical topics in contemporary cybersecurity.