News for hackers. Stuff that matters.
Re:Time to Encrypt the Cloud by dredmorbius on Tuesday February 21, 2017 @02:05AM (#13693848)
If the system relies on user Peggy demonstrating to service Victor that Peggy knows the keys that decrypt or access information, then the system approaches the traditional meaning of "zero knowledge". (Peggy being Prover and Victor being Verifier, see the ZKP Wikpedia page.)

If the system can work with Victor knowing anything else about Peggy, e.g., entirely taking the question "who are you" out of the equation, well, then, we've got an interesting situation.

Re:Time to Encrypt the Cloud by Canada on Tuesday February 21, 2017 @02:41AM (#13694006)
If Alice can share notes with Bob in a manner where the service itself cannot determine that Alice and Bob have any connection at all, then go ahead and market that as Zero Knowledge. If the service can determine who is talking to who, though either passive or active means, then it is disingenuous to claim the service is Zero Knowledge.

Unless the anonymity set is very small or bandwidth is infinite, accomplishing metadata privacy requires some kind of zero knowledge proof.

I don't think such systems necessarily require E2E encryption. If the term zero knowledge continues to be misused, it's going to cause more confusion later when services get around to protecting metadata.

Re:Time to Encrypt the Cloud by dredmorbius on Tuesday February 21, 2017 @02:54AM (#13694066)
Fair points. I've misused the term myself (in ignorance), and can see how this could easily get transformed by a nonexpert public.