Bruce Schneier
Schneier on Security
A blog covering security and security technology.
« Using Agent-Based Simulations to Evaluate Security Systems | Main | NPR on Biometric Data Collection »
September 27, 2012
Replacing Alice and Bob
A proposal to replace cryptography's Alice and Bob with Sita and Rama:
Any book on cryptography invariably involves the characters Alice and Bob. It is always Alice who wants to send a message to Bob. This article replaces the dramatis personnae of cryptography with characters drawn from Hindu mythology.
Posted on September 27, 2012 at 9:10 AM • 81 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Comments
Stuart • September 27, 2012 9:19 AM
So Sita and Rama are wanting to communicate privately, while Alice and Bob are trying to eavesdrop so they can regain their vaunted position?
... couldn't resist.
Craig • September 27, 2012 9:22 AM
And while we're at it, why don't we replace all the arbitrary nomenclature of cryptography, like "cipher", "key", "symmetrical", etc. with terms drawn from Eastern cultures, just to be more inclusive. And the broader culture of mathematics continues to be dominated by European terminology as well. Words like "number", "calculus", "group", "theory", and so on, which unavoidably reflect the mentality of European intellectual imperialism, should be replaced by comparable words selected at random from Far Eastern languages. The familiarity of existing terms is no excuse for continuing the linguistic oppression of non-white cultures!
Ashish Tonse • September 27, 2012 9:23 AM
All this, and nobody mentions Trudy the Intruder.
Won't somebody please think about poor Trudy?
mrmcd • September 27, 2012 9:35 AM
"This choice retains the usual roles of women being at the shouting end
S and men being at the receiving end R (Note : No offense meant to
ladies who read this)."
Oh. Ok then.
Yossi Oren • September 27, 2012 9:37 AM
I would like to suggest Bigthan and Teresh, the two eunuchs who conspired to assassinate king Ahasuerus of Persia, in the Jewish Book of Esther.
According to Jewish scriptures, B and T communicated in ciphertext (actually they used the esoteric Language of Tursi), and Mordecai the Jew was the only one in court who could understand them, since he was a former judge who studied foreign languages.
A primary advantage of B&T over S&R is that there's plenty of Purim-themed clip art online, so presentations will be easy to create ;-)
Sarten X • September 27, 2012 9:40 AM
An interesting proposal, but its strength is also its weakness. By being independent of any well-known story, Alice and Bob (and especially any other characters) are examples without any preconceptions of how the security model is arranged. This permits Alice and Bob to use any scheme for sending their message, no matter how many other actors or interactions are involved.
Switching to Rama and Sita ties the design to the story, such that anyone familiar with the story will expect a particular scheme, apparently involving a single medium with a single key. In the context of the story, how can a complex trust network be represented, or side-channel attacks? How can Rama be assured that the courier Hanuman is trusted to have not altered the message?
Altering the well-known story to accommodate modern situations means that not only must a reader learn the theory being explained, but must also overcome the prior knowledge of how the story's "supposed" to go. That prior knowledge can lead to assumptions, which will likely weaken the model.
Clive Robinson • September 27, 2012 9:40 AM
Hmm, the history of cryptography includes a certain acient 'sex manual", which they currently disown despite the supporting carvings which are a major tourist attraction.
Perhaps when they own up and embrace their cryptographic history and it's associations then they might lay som claim to use other names...
Till then the "eastern cultures" can keep their proverbial apendeges out ;-)
Bob • September 27, 2012 9:40 AM
Where are Ted and Carol? http://www.imdb.com/title/tt0064100/ and http://en.wikipedia.org/wiki/...
No One • September 27, 2012 9:41 AM
It's not a terrible suggestion, though I have one issue with it: Ravana and Rama share initials, so we can't shorten them as S, R, R.
szabi • September 27, 2012 9:42 AM
I have a better proposal. Use Hungarian, and replace Alice with Sándor. This is Alexander in English, so we keep he A, but Sándor looks and sound close to Sender.
Do i get mentioned on the blog? Someone come up with an other exotic language and name, and be famous for bringing up nonsense!
Dale • September 27, 2012 9:47 AM
I think people miss the point that this is just "A talks to B, also maybe to C and D, while E tries to list". It's nicer to read a big document as a story instead of alphabet soup.
Shawn Smith • September 27, 2012 9:51 AM
mrmcd,
"This choice retains the usual roles of women being at the shouting end S and men being at the receiving end R (Note : No offense meant to ladies who read this)."
Oh. Ok then.
That statement makes me think this whole paper is just a joke. At least, I hope that's the case because someone whose job it is to teach everyone who pays for the class needs to know how to communicate effectively.
And his evidence for this S and R story being easier to remember? "Personal experience." Yeah, that's going to convince someone who doesn't already agree with him. /sarcasm
NobodySpecial • September 27, 2012 9:54 AM
Presumably some other religion will complain about Hindu, Jewish characters - so the safest thing to do is just use Klingon. Then nobody can be offended.
Of course is does mean that lecture notes will include "K'Ehleyr communicates to K'mpec while K'nera eavesdrops" - but this will just encourage students to pay more attention.
Spaceman Spiff • September 27, 2012 9:59 AM
Let's just make it anonymous and gender/culture neutral: " wants to send a secure message to ..."
Spaceman Spiff • September 27, 2012 10:00 AM
Crud. The html parser ate my post! Here it is again.
Let's just make it anonymous and gender/culture neutral: "[insert name 1 here] wants to send a secure message to [insert name 2 here]..."
Jim • September 27, 2012 10:07 AM
Why use humans at all? "Cat wants to send a message to Dog while Raven eavesdrops."
derpp • September 27, 2012 10:14 AM
my university uses A for alice and B for bob for absolutely every scenario on the chaulk board. using the names of gods in a religion is a reallly bad idea i can already envision the lawsuits and human rights tribunals in my country for slandering their gods. I also vote for Klingon though possible paramount lawsuits
atis • September 27, 2012 10:22 AM
This probably works well for teaching Hindu audience, but I couldn't distinguish Rama and Ravana, as they start with Ra.
It's also bad example of cryptography, because if Sita is kidnapped, attacker would his hands on Sita's jewelry (that was used as signature), so attacker could fake any message.
Alex • September 27, 2012 10:23 AM
It's just "Alice" for "A" and "Bob" for "B", as in sending "from A to B". Are they suggesting "Sita" for "S" and "Rama" for "R", so it the same as "from [S]ender to [R]eceiver"? It makes sense, but really, who cares?
Pete • September 27, 2012 10:29 AM
But I feel I know Alice and Bob better than some of my Facebook friends. I can't just discard them!
Alan Bostick • September 27, 2012 10:37 AM
@Pete: Do you really know Alice and Bob, or do you know just the simulacra of them that Mallet has substituted in your datastream?
JP • September 27, 2012 10:43 AM
Why not follow international standards...
Alfa sends a message to Bravo
Charlie and Delta also play
Echo is the eavesdropper
[snip]
Victor represents success
and Whiskey is my protector...
Isaac • September 27, 2012 10:44 AM
The use of Bob and Alice is to make thing simple to remember. It is the understanding of the concept that matters most. The use of common name make it a good candidate.
atk • September 27, 2012 11:06 AM
@atis: why is yhis an example of bad crypto? In what crypto system does access to the key *not* grant the ability to impersonate?
Jovca • September 27, 2012 11:14 AM
Occasionally, I have to explain cryptography to laymen. After 5 minutes or so, their eyes glaze over and they can't follow who's adversary in the story: Eve, Alice or Bob. I replaced Eve with Hitler: it's obvious he's the bad guy, it makes the audience pay more attention, and always brings out few chuckles.
Ben • September 27, 2012 11:17 AM
I just read the paper and I can't remember what the names of the gods are already. Some name starting with S some name starting with R - oh wait, R was meant to be the threat force.
I don't really care whether you want to call them A or B or Red and Blue, or something like that.... But as far as I'm concerned the names in the paper are as memorable as if someone just mashed their fist into the keyboard. Why change what already works well for something that doesn't seem to have any advantages other than being a neat play on some - at least in Western society - fairly obscure story?
Shaftway • September 27, 2012 11:20 AM
@szabi Only if three of your four citations reference Schneier.
Clipper • September 27, 2012 11:24 AM
Some dudes on this earth really really have nothing interesting to do of their life. How about discussing the use of greek alpha for angles and replacing it with an arab sign ? Who cares about these things ? Crap.
lonegeek05 • September 27, 2012 11:41 AM
Okay, so this "story" is memorable for the author. It's memorable for people of that culture. To a majority of the "audience" it will be utter nonsense - building a whole storyline where it's not needed to explain crypto. It also ties crypto to a particular cultural understanding and background that has NOTHING to do with crypto. Please, leave Alice and Bob alone.
lol • September 27, 2012 11:43 AM
As an added bonus India, Sri lanka and China can burn down your embassies for insulting their gods once they start using the new hindi standard. In fact let's call these scenarios Christ and Mohammad nothing could possibly go wrong
OldFish • September 27, 2012 12:17 PM
Xenophilia. Sounds creepy doesn't it? I'll explore the food, art and music of other cultures but give their rituals, religions and internecine conflicts a total miss.
Ken • September 27, 2012 12:50 PM
Change is good. You go first.
But in this case, I'll stick with what I know, Alice and Bob and friends.
matt • September 27, 2012 12:57 PM
also possible to just don't use a name )
"sender wanna send a message to receiver"
name • September 27, 2012 1:06 PM
I think you people are taking this paper more seriously than the author intended it to be taken.
Bob • September 27, 2012 1:11 PM
@Zaphod you don't want that Eve is too clingy and spies on me all the time.
Figureitout • September 27, 2012 1:11 PM
Obviously this paper is a joke, chill out people! Maybe an attempt to get a post by Bruce. Alice,Bob, Eve & Co. are a meme that isn't going anywhere.
As Mr. "lol" (don't mind if I do) pointed out, using something like "Malicious Mohammad" may cause some people to become unnecessarily enraged...
Harry • September 27, 2012 1:14 PM
Goodness that was fast: this thread is already referenced in the proposal. The author suggests a different name for the man in the middle, albeit a name not in the Sutra.
lol • September 27, 2012 1:15 PM
The author could've written instead about how the propagation of errors works. By simply changing the Alice and Bob standard in cryptography books you've now inadvertently banned all these books from importation, possession and citation in dozens of countries due to blasphemy and apostate laws.
Reading any of these new books aloud in a Saudi, Iranian, Kuwaiti, Malaysian, Pakistani, ect university almost guarantees the arrest of the instructor for proselytizing as well.
curtmack • September 27, 2012 1:27 PM
@Spaceman Spiff: Actually I liked the first one a lot. I think " would be a great sender, and ..." is the best possible name for the recipient.
This looks like a quotation that ends in an ellipsis, but in fact it is a perfectly self-documenting transmission between " and ..."!
"A'o pztzijkgk lsc etlwhypg avfv ab xpi sgvorv wj uwevqmvk kzkz. Vx eej ckuq sn wzdnf..."
moo • September 27, 2012 1:54 PM
At one time the names would have been arbitrary, but now they are established convention. They are a useful shorthand, and there is no possible benefit from changing them.
Its sort of like programmers with their use of "foo" "bar" "baz".. all programmers use these as meta-syntactic variables. They seem meaningless to outsiders, but they're convenient when you need to slap a noun-label on something so you can talk about it in the abstract (or illustrate some properties of an entire class of things that it belongs to) without worrying about what it actually is.
Everyone knows Alice, Bob, Eve now and you can assume the basic properties of those roles when those names are used even if the speaker doesn't explicitly mention them. Convenient shorthand.
Bill Stewart • September 27, 2012 2:09 PM
If Sita is only sending, and Rama is only receiving, then those names are fine, but it's likely to be a fairly specialized protocol.
The real questions I've had are whether C is Carol or Charlie, and when you're doing illustrations, is it Bob Dobbs smoking a pipe or Bob Marley smoking a spliff?
Gweihir • September 27, 2012 3:16 PM
Seems all important problems are solved if such nonsense is even worth a story. Maybe while we are wasting time, we could also replace the much-maligned foo and bar with something different?
Alan Kaminsky • September 27, 2012 3:32 PM
I vote for Harry and Sally. "I'll have whatever [cipher] she's having . . ." :-)
Chris W • September 27, 2012 3:46 PM
This is an obvious case of don't try to fix what isn't broken.
The point of Alice & Bob is to keep thing simple and obvious. Much like Lorem Ipsum.
You don't want parts of your audience distracted wondering where you got those names from, or the story behind them.
Still, in another language other names may be more obvious.
Carl "Bear" Bussjaeger • September 27, 2012 4:42 PM
OK, we'll ignore the very narrow specificity of the proposed nomenclature. We'll ignore the (possibly tongue-in-cheek?) poke at women. We'll even ignore the implicit religious bias in the Concluding Remarks. Maybe this was only satire. Heck, let's forget that he's simply proposing tossing out a familiar and well-accepted standard for no no discernibly decent reason.
Gods (of whatever your preferred cultural milieu), I hope this was satire. Because I'll be damned if I'm going to take seriously an academic paper that includes Wiki-freaking-pedia in the references.*
(* I'll consider an exception for papers about Wikipedia.)
Carl "Bear" Bussjaeger • September 27, 2012 4:49 PM
Seriously, Bruce: This "paper" references Wikipedia, YouTube, and a blog (granted, your blog, but a blog... an entire month of the blog). Where did you find this thing? What was the context? Is this person just hoping to be the next Sokol?
Steve Russelle • September 27, 2012 4:56 PM
I suggest names based on the anti-phoenetic alphabet: Aisle, Bdellium, Chaos, Djinn, etc.
While supporting the concept's peculiar bent, it also scuttles it. This will have the beneficial effects of handicapping even the English speaking presenter and will leave everyone feeling uneasy.
You're Not The Boss Of Me • September 27, 2012 5:19 PM
As a fan of the TV show "Malcolm In The Middle", I vote we change Mallory/Mallet...
...which of course means changing Alice and Bob to Reese and Dewey.
Carl 'SAI' Mitchell • September 27, 2012 5:48 PM
Names, for each letter of the English alphabet, alternating male/female:
Alice
Bob
Carol
David
Eve (Evil)
Frank
Greta
Hitler/Harry (Hitler is an obvious attacker, as mentioned above)
Irma
Joseph
Kathrine
Leo
Mary
Norman
Olivia
Patrick
Quanita
Robert
Samantha
Tad
Uma
Vladimir
Wanda
Xavier
Yolanda
Zach
That gives 26 names, most reasonably short, 13 male, 13 female, each starting with a different letter.
eigenperson • September 27, 2012 6:08 PM
I generally have Sally Ride send a message to her fellow astronaut Robert Stewart. That way, the initials ensure that there can be no possible confusion about who is the sender and who is the receiver.
thinkingcap • September 27, 2012 9:26 PM
Alice and Bob have been the classic in cryptography and would always be a classic in the field of cryptography. A mythology may be familiar to someone but may not be familiar to another who have no idea what the myth is about. Whereas, Alice and Bob are generic and can be more easily understood without the knowledge of any myth of culture.
Anonymous Coward • September 27, 2012 10:43 PM
If you're teaching a group of people familiar with Hindu mythology already, and who aren't going to be moving beyond surface-deep in cryptography, it's a great illustration to help non-specialists (e.g. grandma) understand some key concepts. Hopefully, this is what the author does.
Anonymous Coward • September 27, 2012 10:46 PM
Oh yeah, and this story sounds interesting, so I'll probably have to read some Hindu literature. Heck, I may even read it to my children, partly just to illustrate some crypto concepts. (There I go, leaking side channel info again)
AC2 • September 28, 2012 3:46 AM
Well now I know what I'll call the new version of OpenSSL: Hanuman!!
But yeah this is one of those analogies that is a bit leaky...
Hemraj • September 28, 2012 3:47 AM
Yes...I like this change..."SITA - RAMA"
and I will follow this change from now onwards...
Thanks to share...SIR
Miguel Farah • September 28, 2012 6:05 AM
And they said I was nuts(*) to do a Spanish-language version with Alberto, Blas, Carlos and Daniel... fools! I'll destroy them all!
(*) Actually, they said I was sexist. I wonder why?
AliceBobSitaRama • September 28, 2012 8:14 AM
The author's tone sounds a bit tongue-in-cheek, I think that this paper is a bit of a troll.
But I was wondering about something, how important is it to be able to assign a sender and a receiver roles to two people exchanging messages, when you have a group of messages, especially when it is not always possible to sequence the message (the messages lack a precise date/time)?
TS • September 28, 2012 8:24 AM
1000 years from now, the myths of Alice, Bob and Eve will be in the general conscious and no one will believe that they were just random names to illustrate a concept.
Bill • September 28, 2012 9:23 AM
http://www.cnn.com/2012/09/27/tech/...
After reading that article above, it seems that Indians might need some cultural help in explaining the need for cryptography or privacy.
AlexandreZani • September 28, 2012 10:40 AM
The whole idea of having a "sender" character and a "receiver" character is a mistake. Let's say we are talking about a key-exchange protocol. Who is sending and who is receiving? Or a voting protocol? Or some sort of secret aggregation protocol?
B. D. Johnson • September 28, 2012 10:44 AM
When I'm explaining stuff to laypeople, I tend to fall back on Leia sending a message to Obi-Wan and Vader is trying to intercept. R2-D2 is the cyphertext.
Of course, the utter failure to encrypt a message of that nature does kind of poke a hole in the metaphor. If Vader had found R2-D2 the simple act of removing a foreign piece of metal sticking out would have revealed not only the weakness in the Death Star but shown that one of the two surviving Jedi were still alive and exactly where he was and that Alderaan was openly fighting against the Empire. Yea, there's an off reference in the message that "my father would know how to retrieve it" but it couldn't have been that secure, as her father was, presumably, soon killed when the planet was blown up, but they still managed to retrieve the data.
No One • September 28, 2012 12:20 PM
@B. D. Johnson: As has been established, R2 is the true hero of the epic. He faked malfunction to entice Luke to let him get to Obi-Wan. OBVIOUSLY.
Dave • September 28, 2012 2:14 PM
Naah, this will never work. Sita and Rama run the Bombay Palace just down the road from here, and Sita shouts orders into the kitchen for Rama. Anyone can eavesdrop, and given Sita's Madras accent and the fact that Rama knows her voice, pretty much no-one can forge messages. So you'd need a better example than that...
localhost • September 28, 2012 8:39 PM
Leave the profit of industry and labor "Peace Be Upon Him" to do his work unmolested from the witchcraft of the infidel "Alice".
According the prophecy Bob "Peace Be upon him" Must continue and promote his works and all his malevolent ways, defeating Alice who will receive only a crushed head and Bob a Bruised heal for all her wasted effort.
better?
Niels • October 1, 2012 1:25 AM
ok, so how about som good old Frisian names for fun: fokke and sukke ... might as while through in some global shock value while we're at it ...
Niels • October 1, 2012 1:28 AM
ok, so how about some good old Frisian names for fun: Fokke and Titie ... might as while throw in some global shock value while we're at it ...
Bill • October 1, 2012 3:50 AM
Sure, why not add religion to security, a subject that already struggles with irrationality... oh wait.
Will the bible bashing states proposing Adam & Eve?
Oh well, it'll take the focus off evolution and climate change! :)
Danny Moules • October 1, 2012 6:55 AM
"separated by a hostile environment. They can trust nobody, and have to take a lot of precautions."
Trying to attribute personifications and context to the characters defeats the object. Alice and Bob. A and B. Environment and entity genus agnostic. Alice and Bob can be programs. They can be in a hitherto unforeseen circumstance involving flowers, space aliens and WD40. They are not laden with connotations and that's what makes them so useful.
Ahem. Right, going back to being productive now.
bob • October 1, 2012 8:44 AM
@Craig
Cipher is from Arabic.
Also, you seem to be taking a fairly jokey paper (notwithstanding how useful adding humorous context to arbitrary notions is when teaching) a bit too seriously.
The author forgets one key detail: this is cryptography. The Alice and Bob system has been used for decades without exploit. Never once have names been subverted such that Bob intercepts the message from Alice to Eve (as steamy as those messages may be).
Sita and Rama are new on the scene, with an untested language to build their theories on. It will take decades to ensure the metaphors are not corruptible. Only then would it be safe to make the transition. And only if the math proves Alice and Bob might be exploitable
Andrew • October 4, 2012 4:28 PM
PC at its finest. Sita is what gender again?
I was waiting for the "Ha Ha, jokes on you" near the end.
It is impossible to offend no one.
Mandip Kaur Sandher • November 23, 2012 10:59 AM
http://en.wikipedia.org/wiki/Al-Kindi
Cipher is Arabic from sifr - zero or empty. He was a pioneer in cryptanalysis and devised several new methods of breaking ciphers.
“Logic will get you from A to B. Imagination will take you everywhere.” Einstein
If we apply a sense of humor to the Sita and Rama proposal, we will see that there is more than meets the eye on this "Creative Blast" from the Universe. Experience is what matters.
How much RAM do you have? RAM is the name of RAMA - it's already running our memory!
All languages are connected. Quantum Science tells us that all things in the Universe are connected. Consciousness is one.
HAHA ... is a Punjabi alphabet letter ... written in phonetics GurMukhi (from the Teachers Mouth. See note above this one ... yes Ha Ha the Universe is spinning its tricks again with us all.
Sita is a name of an airline. Sita is invisible like the air. Eve means Hava or AIR! Adam is red earth ADAM. These words are in the Eastern cultures too just not understood sometimes.
It is the meaning we need to connect with and then the massive jigsaw comes together like a beautiful tapestry. We encoded now we are decrypting the al-go-rithms (All Go Rhythms) of the Universe. It's a friendly dance of unity of all things. Enjoy the game.
Subscribe to comments on this entry
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.
|
| Subscribe |
Subscribe via Kindle |
| Blog Menu |
SearchPowered by DuckDuckGoBlog Home Page
Archives by Date2014 J F M
Tags  |
| Latest Book |
more books by Bruce Schneier |
|
Leave a comment