Thread

1. bzmrgonz · 1789618128 · focus · HN ↗

   It baffles that people think it's a bad thing to disclose a public key. That's their purpose actually. Sure we now have the post quantum computer threat, and some state actors are harvesting keys, but quantum computer is going to disrupt so much, that Id verification won't even matter really.

   1. morsch · 1789623646 · focus · HN ↗

      Think about it, the key analogy is just terrible. In the origin domain, losing a key is always bad, and making a key available to all is a non sequitur.

      It's not like non-technical people understand asymmetric cryptography. Or even technical people, for that matter.

      Maybe we should refer to the public key as an address, and the private key is just a password again. You can send stuff, securely, to an address. And you can verify the sender when you have their address (ie check the signature).

      1. fc417fc802 · 1789624845 · focus · HN ↗

         The key analogy is perfect for the private key and for symmetric keys. Publishing those is always bad and means you need to rekey immediately just like losing a traditional physical key to a secure building would.

         The public counterpart is tricky to name but I think attaching "public" to it makes the intended usage plenty clear. There isn't really a physical counterpart unless you consider maybe those machines that check for counterfeit cash but even that's not a great fit because the pubkey is simultaneously analogous to a lock box.

         1. tialaramex · 1789636560 · focus · HN ↗

            Not quite. The analogy works for secret keys (what you're calling "symmetric keys") but a private key is unlike real world key analogies because as you'll quickly discover if you deploy real world keys in a high security environment people can examine the lock to figure out the correct key. The whole point of private keys is that this cannot work in a public key system. That step does not exist.

            It is true that publishing your private key is bad but you'd hope the name makes that pretty clear. Despite the way I remember (U2's "The Fly" lyrics, "A secret is something that you tell one other person, so I'm telling you, child") people generally do not understand that the whole point of secrets is that at least two parties know, which means you might always be betrayed by somebody you think is keeping your secret. For a private key it's easy, don't tell anybody, nobody knows, you can't be betrayed, done.

            For example Hacker News learns my password to this web site every single time I sign in because that's just a secret. We've known how to do better for decades but only a handful of systems I use (e.g. Google) do so and all of them have a "traditional" password option which is like discovering your aeroplane still has a smoking section in 2026.

            1. fc417fc802 · 1789642138 · focus · HN ↗

               I don't see the issue. Attacking a physical lock as you suggest is analogous here to breaking the cryptography in some way. So the NSA busts out its sooper sekrit quantum computer ...

               The inability to betray is a sharp observation but I think the analogy still holds flawlessly. It's a physical lock that you haven't handed out the key for so you're the only one with access to it. However the public counterpart still defies easy explanation.

               Why did you put "symmetric keys" in scare quotes? Is that not the common term in your neck of the woods when speaking about symmetric crypto?

               1. TeMPOraL · 1789662470 · focus · HN ↗

                  Again, the "lock" part is the dumb part.

                  Encryption scrambles the data. Key is the piece of information that lets the information be scrambled in specific way so that it can be unscrambled by someone in possession of the same (symmetric) or complementary (asymmetric) key.

                  The only "lock" in the whole thing is the scrambler (encryption software), and that one is usually publicly known and available.

                  Obvious way to make this clear: if "keys" were a lock, the original data in readable form would be there, accessible if you found a way to bypass or destroy the lock. The whole point of encryption as opposed to locking is that you cannot do this, because the data itself is scrambled - and thus you don't even need to ship any "lock", just the scrambled data, because the "lock" is something everyone already has or can procure.

Unofficial Hacker News client; not affiliated with Y Combinator.