An Ethics Question ...

[J_B_]

Even though there is an ethics forum, I thought this might fit better here due to the nature of my question.

Suppose there were a mathematics professor who specialized in prime numbers, and he found the ever-elusive way to do prime factorization of a product. Prime factorization is a special and very important subset of the P vs. NP problem, and the RSA computer encryption that protects all our most sensitive information is based on an assumption that P!=NP.

What should that professor do? Publishing his results seems an irresponsible thing to do, as it would advertise to all the world's hackers that there is probably a way to crack RSA. But if he reported his findings to someone like DHS, they might try to bury his findings and he would be left with no reward - possibly no vocation - with which to continue a normal life.

 

[durangodawood]

Even though there is an ethics forum, I thought this might fit better here due to the nature of my question.

Suppose there were a mathematics professor who specialized in prime numbers, and he found the ever-elusive way to do prime factorization of a product. Prime factorization is a special and very important subset of the P vs. NP problem, and the RSA computer encryption that protects all our most sensitive information is based on an assumption that P!=NP.

What should that professor do? Publishing his results seems an irresponsible thing to do, as it would advertise to all the world's hackers that there is probably a way to crack RSA. But if he reported his findings to someone like DHS, they might try to bury his findings and he would be left with no reward - possibly no vocation - with which to continue a normal life.

Great dilemma! I can imagine other more or less extreme flavors of the ethical problem, such as: the professor makes some important microbiology discovery that can allow for easy production of horrible bioweapons.

Will have to puzzle over this. I have a just-publish instinct. But first takes arent well thought through by definition.

I also want to subvert your problem by inventing a way for the scientist to get delayed but still satisfying credit. Not sure if thats valid.

 

[J_B_]

Great dilemma! I can imagine other more or less extreme flavors of the ethical problem, such as: the professor makes some important microbiology discovery that can allow for easy production of horrible bioweapons.

Will have to puzzle over this. I have a just-publish instinct. But first takes arent well thought through by definition.

I also want to subvert your problem by inventing a way for the scientist to get delayed but still satisfying credit. Not sure if thats valid.

I'm interested to here your answer when you get there.

 

[sjastro]

Even though there is an ethics forum, I thought this might fit better here due to the nature of my question.

Suppose there were a mathematics professor who specialized in prime numbers, and he found the ever-elusive way to do prime factorization of a product. Prime factorization is a special and very important subset of the P vs. NP problem, and the RSA computer encryption that protects all our most sensitive information is based on an assumption that P!=NP.

What should that professor do? Publishing his results seems an irresponsible thing to do, as it would advertise to all the world's hackers that there is probably a way to crack RSA. But if he reported his findings to someone like DHS, they might try to bury his findings and he would be left with no reward - possibly no vocation - with which to continue a normal life.

No problems with censorship if he submitted his proof to the Clay Mathematics Institute.
It's on their list of the unsolved millennium prize problems.

Solve any one of the problems on the list and you get a million dollars.
The extra dilemma is would the professor decline the financial reward while at the same time retarding progress in mathematics.

The last problem in the list the Poincare conjecture has been solved by the mathematical genius and Rasputin impersonator Grigori Pereleman.
Not being satisfied with refusing to accept the Fields Medal which is the Nobel Prize equivalent in mathematics he also declined the one million dollars in solving the conjecture giving the following bizarre reason.

 

[PloverWing]

I don't think prime factorization is NP-complete, so finding an efficient algorithm for factoring primes wouldn't solve P=NP.

If I came up with the prime-factorization algorithm, I don't think I could resist publishing it. It's just too major a discovery.

As to the ethics: My sense is that any encryption system that depends on a mathematical falsehood is unreliable. If RSA is flawed in this way, then it's flawed, and we need to devise a better encryption system.

 

[durangodawood]

As to the ethics: My sense is that any encryption system that depends on a mathematical falsehood is unreliable. If RSA is flawed in this way, then it's flawed, and we need to devise a better encryption system.

The point of option B (not publish) is to give our national security system at least a heads up to deal with stuff before the current encryption regime is thrown open.

I dont think this option proposes the factoring breakthrough is bottled up forever. Thats just not realistic.

 

[J_B_]

The point of option B (not publish) is to give our national security system at least a heads up to deal with stuff before the current encryption regime is thrown open.

I dont think this option proposes the factoring breakthrough is bottled up forever. Thats just not realistic.

Exactly. But at the same time, imagine the power you're handing over. I suppose if you're an ultra-patriot, you wouldn't see any issue. But, while national security works on an alternative, at the same time they now have a way to eavesdrop on anyone anytime they please without their knowing it.

I believe RSA occasionally posts puzzles with a reward for solving them as a way to keep tabs on who is working on P vs. NP. I wonder if DHS, etc. also watch such people.

 

[PloverWing]

I believe RSA occasionally posts puzzles with a reward for solving them as a way to keep tabs on who is working on P vs. NP.

I assume you mean the NSA? RSA is just the three guys who invented the algorithm, Rivest, Shamir, and Adleman. Though maybe Rivest, et al, like posting puzzles too.

As to the larger question of whom to notify, if anyone: I don't like the option of notifying the US Government (NSA, DHS, etc) before notifying the computer companies, for the reason that you said. I don't want to give the Government the option of spying on my private transactions. If I notify anyone, I would want to notify the US Government and the computer companies simultaneously. And publication would do that; I assume the cryptographers at the NSA and at most major software companies pay close attention to the journals.

So to me, the alternative option would be to refrain from telling anyone. I, personally, would know that RSA is now vulnerable, but no one else would know. When I write that down in black and white, it seems a precarious state of the world. If the vulnerability is there, maybe some hacker or some other nation's spy agency is going to discover it too. In which case, best if everyone knows all at once.

Great dilemma! I can imagine other more or less extreme flavors of the ethical problem, such as: the professor makes some important microbiology discovery that can allow for easy production of horrible bioweapons.

An interesting parallel, because I wouldn't want to see the bioweapons developed. Is my attitude there different because biology isn't my field? (Never underestimate the power of self-interest!)

I also want to subvert your problem by inventing a way for the scientist to get delayed but still satisfying credit. Not sure if thats valid.

Wikipedia tells me that Clifford [bless and do not curse][bless and do not curse][bless and do not curse][bless and do not curse][bless and do not curse] independently invented a system similar to RSA encryption in the UK in 1973, but that it wasn't publicly known until 1997 because it was classified top-secret. So that's probably the delayed-credit path.

 

[PloverWing]

Sigh. The British mathematician mentioned above has a last name that starts with C and is a synonym for "roosters". CF has decided to bleep it out. I wonder how often the poor guy gets his name bleeped?

 

[J_B_]

I assume you mean the NSA?

I meant RSA, though maybe they work together.

RSA is just the three guys who invented the algorithm, Rivest, Shamir, and Adleman.

Yes, I know, but it's also a company: RSA Cybersecurity and Digital Risk Management Solutions.

If the vulnerability is there, maybe some hacker or some other nation's spy agency is going to discover it too. In which case, best if everyone knows all at once.

Yeah, that's another route. It's sort of a combination of popular democracy & survival of the fittest. But now that I think about it, the reaction would probably be similar to COVID. Everyone would go into lockdown of their critical information until a solution was found. That would be a huge disruption.

In that regard, maybe it would be best if the one who discovered it kept it a secret until they also found an alternative so that they could offer both simultaneously.

 

[PloverWing]

Yes, I know, but it's also a company: RSA Cybersecurity and Digital Risk Management Solutions.

Okay, that makes sense.

 

[Astrid]

Even though there is an ethics forum, I thought this might fit better here due to the nature of my question.

Suppose there were a mathematics professor who specialized in prime numbers, and he found the ever-elusive way to do prime factorization of a product. Prime factorization is a special and very important subset of the P vs. NP problem, and the RSA computer encryption that protects all our most sensitive information is based on an assumption that P!=NP.

What should that professor do? Publishing his results seems an irresponsible thing to do, as it would advertise to all the world's hackers that there is probably a way to crack RSA. But if he reported his findings to someone like DHS, they might try to bury his findings and he would be left with no reward - possibly no vocation - with which to continue a normal life.

Announce to all that the solution
has been found.
Make sure the govt believes you!

Work out a date well in the future to
release the info.

 

[chevyontheriver]

Even though there is an ethics forum, I thought this might fit better here due to the nature of my question.

Suppose there were a mathematics professor who specialized in prime numbers, and he found the ever-elusive way to do prime factorization of a product. Prime factorization is a special and very important subset of the P vs. NP problem, and the RSA computer encryption that protects all our most sensitive information is based on an assumption that P!=NP.

What should that professor do? Publishing his results seems an irresponsible thing to do, as it would advertise to all the world's hackers that there is probably a way to crack RSA. But if he reported his findings to someone like DHS, they might try to bury his findings and he would be left with no reward - possibly no vocation - with which to continue a normal life.

Publish it. Make it public. Lets say IF there is such a method and the NSA or the Chinese or whoever figures it out and exploits it secretly it could be very bad for individuals, organizations, and countries. Better to have the truth of a bad algorithm known by everybody than only by some nefarious fellows or nefarious agencies. In this way our mathematician is actually protecting people in a general sense. Before publishing, give the RSA LLC a bit of notice so they can do right by their users. For me the ethical question is 'how much advance notice do you give them?' But it is ethically obvious to me that making it public would be a necessary thing because if I could figure it out so could others eventually. The truth needs to be known so nobody continues to use a useless algorithm. Making it public, in the end, is the only responsible thing to do.

 

[chevyontheriver]

Great dilemma! I can imagine other more or less extreme flavors of the ethical problem, such as: the professor makes some important microbiology discovery that can allow for easy production of horrible bioweapons.

Slightly different. Interesting question. But then the information to make horrible bioweapons is kind of already out there. I doubt it would be all that hard for a medium sized corporation, a small country, or a big university lab to do it with available tools and techniques. And somebody will do it because they can.