-
18 votes
-
German Navy Enigma machine systems were different to the Army, making them tougher to crack. In this video, James Grime discusses the differences and what Alan Turing achieved in breaking the code.
8 votes -
Encryption At Rest: Whose Threat Model Is It Anyway?
15 votes -
Surveilling the masses with wi-fi-based positioning systems
15 votes -
The unbreakable Kryptos code
18 votes -
A quick post on Chen’s algorithm
11 votes -
Why isn't Bluesky a peer-to-peer network?
12 votes -
Quantum resistance and the Signal Protocol
23 votes -
Cryptography may offer a solution to the massive AI-labeling problem
9 votes -
How Signal walks the line between anarchism and pragmatism
45 votes -
A simulation of first contact ran on May 24, 2023. Here is the website with the details.
15 votes -
Hackers can steal cryptographic keys by video-recording power LEDs sixty feet away
12 votes -
How codebreakers decrypted a trove of long-lost letters written by Mary, Queen of Scots
7 votes -
Lost and found: Codebreakers decipher 50+ letters of Mary, Queen of Scots
7 votes -
Three lessons from Threema: Analysis of a secure messenger
7 votes -
One-Time Programs
10 votes -
Hardening SSH
4 votes -
In defense of crypto(currency)
6 votes -
How cryptocurrencies actually work
7 votes -
Cryptographic Digital Art Tokens, a concept
Hi folks. I'm posting this in ~creative because I want to see what other artists think of it; the technical side is important too, but artists and art are the focus of this project. Cryptographic...
Hi folks. I'm posting this in ~creative because I want to see what other artists think of it; the technical side is important too, but artists and art are the focus of this project.
Cryptographic Digital Art Tokens are a concept I've been working on for a while, to provide some of the benefits of crypto tokens without perpetuating the harm they create.
CDATs are not NFTs. They are not designed to facilitate investment, but rather collection. They do not use a blockchain and do not rely on distributed consensus at all. Instead, they use traditional cryptography to validate the ownership of art.
How CDATs Work
Let's say an artist Adam creates a piece of art called One. He decides he wants to sell a CDAT of One, so he creates a CDAT key and publishes his public key on his website, adam.art.
A collector, Beth, decides she wants to buy One. She e-mails Adam and they agree on a price, and exchange keys; once she has paid, Adam sends Beth a CDAT, which he has signed. Beth then cross-signs the CDAT and sends it back to Adam. It ends up looking like this:
=== CDAT DATA === Artist: Adam <adam@adam.art> Collector: Beth <beth@betawork.codes> Date of Sale: 2021-12-08T19:50:56Z Title: One, a Digital Story Work ID: art.adam.one Cover Hash: e82c294938320bf4fab56970f52e1ddf Work Hash: 3179c999f1d4fab4bcc8a57bca1c9d8c Artist Key Fingerprint: c634d0420f825b91 Collector Key Fingerprint: 3b2e3bbf91ec96c2 === CDAT SIGN === Artist Signature: YTtsc2tkamY7bHNramY7bGtqZDtsa2pmYTtsZGt... Collector Signature: cXdpZXVwcXdpeXR1djtsbmFvdWNuZWN2cHdl... === CDAT META === Cover URL: https://adam.art/images/one-cover.jpg Work URL: https://adam.art/art/one.zip Artist Key URL: https://adam.art/static/cdat.key Collector Key URL: https://betawork.codes/ === CDAT OVER ===
In an ideal world, with all the software enablement I want to do, Beth would be able to take this token and put it in a digital gallery or on her website, where the art piece, and her ownership of it, would be proudly displayed for all to see in a user-friendly, beautiful format.
Structure
The CDAT has three sections - DATA, which is signed, META, which is not, and SIGN, which contains the CDAT's cryptographic signatures. Hashes and key fingerprints are in the DATA section, but URLs are in the META section, which means they can be changed later; artists and collectors can re-host their art and keys, so long as the files' hashes or fingerprints remain exactly the same.
Semantics
Because the CDAT is cross-signed, anyone can see that both Adam and Beth have agreed to the sale. Assuming the signatures and keys all check out, Beth can now prove to people that Adam sold her his art, and Adam can prove that Beth bought it.
Implementation
In order for this interaction to work, we technically need only existing technology: you can validate such things with GPG and some manual reordering. Ideally, though, we'd have a few tools:
- A CDAT validation program. This should include a command line program and a GUI (maybe even a mobile app?), and would validate the following information:
- The given signatures are valid and correct for the given CDAT.
- The keys used to sign the CDAT match both the given fingerprints and identities.
- The linked key URLs, if any, in fact point to the indicated keys.
- The linked art and cover URLs, if any, in fact point to files with the given hashes.
- A CDAT creation program. This should include a command line program and a GUI. It would take as input the relevant keys and names, provide a way to set the date, and ensure that everything relevant is online at the given URLs.
- This program would be used by both artists (to create CDATs) and collectors (to cross-sign CDATs).
- A CDAT hosting service. Obviously there could be more than one of these, and people could host their CDATs and art on their own machines - that's decentralization, baby! - but it would be very nice to be able to host CDATs, art, and keys for free or a nominal fee.
This would be a great start, but in order to really kick-start the ecosystem, it would be nice to provide some additional enablement software, such as:
- A drop-in HTML embed that uses client-side JavaScript to display and validate CDATs on a website.
- A browser extension which validates CDATs found on arbitrary websites, on the user's request.
- A self-hostable CDAT gallery for artists and collectors which displays who owns what, and which art pieces are still for sale.
Please let me know if this idea is interesting to you, and ask any questions/leave comments!
9 votes - A CDAT validation program. This should include a command line program and a GUI (maybe even a mobile app?), and would validate the following information:
-
The Moral Character of Cryptographic Work by Phillip Rogaway
5 votes -
Standard Notes completes penetration test and cryptography audit
14 votes -
Let's crack Zodiac: 51-year old 340 cypher is solved
14 votes -
Marine archaeologists catch a break on the bottom of the Baltic Sea: A 75-year-old Enigma machine
12 votes -
EU Draft Council Declaration Against Encryption [pdf]
10 votes -
US Government Continues Encryption War
7 votes -
How we recovered over $300K of Bitcoin
5 votes -
Using zero knowledge proofs to prove set membership without exposing the set or the member
5 votes -
Another Look at Provable Security
6 votes -
Looking back at the Snowden revelations
14 votes -
Cracking the Code of Cicada 3301 [Episodes 1-4 Playlist]
4 votes -
Almost All Web Encryption Works Like This (SP Networks)
3 votes -
How does Apple (privately) find your offline devices?
13 votes -
Programmers solve MIT’s 20-year-old cryptographic puzzle
12 votes -
Undertaking the crucial task of bringing cryptography to activists
4 votes -
On ghost users and messaging backdoors
8 votes -
GnuPG can now be used to perform notarial acts in the state of Washington
15 votes -
A band of Polish mathematicians figured out much about how German Enigma encoding machines operated, years before Alan Turing did
6 votes -
The quest to find William Shakespeare's library
3 votes -
The Crypto Anarchist Manifesto
10 votes -
Meet TLBleed: A crypto-key-leaking CPU attack that Intel reckons we shouldn't worry about
13 votes -
Suggestion: Users can upload GPG public keys
Users can upload gpg public keys for DMs and Clear Sign comment bodies. Honestly, a very very low priority feature request, but what is the initial feeling on something like this?
14 votes -
Signing CryptPad - Experiments with making a webapp secure despite the server
7 votes -
SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTools and python-gnupg (CVE-2018-12020)
5 votes -
An Analysis of Cloudflare's Email Address Obfuscation
5 votes