Feeds

'Replace crypto-couple Alice and Bob with Sita and Rama'

Even their jobs are being offshored

  • alert
  • submit to reddit

SANS - Survey on application security programs

A computer scientist has come up with a proposal to replace cryptography's Alice and Bob with characters from Hindu mythology.

For decades, techniques to encrypt and decrypt communications have been explained using two imaginary characters, Alice and Bob, and potential eavesdropper Eve. Alice sends a message to Bob, and Eve is always trying to intercept it - the little sneak. Alice and Bob first came to light in 1978 in a groundbreaking paper [PDF] on the RSA algorithm for public-key cryptography.

Dr S. Parthasarathy, a part-time lecturer and full-time employee of Indian biz Algologic Research & Solutions, suggests a cast change in the dramatis personae of cryptography with Sita and Rama, two central characters in the Hindu mythological epic Ramayana. The proposed sacking-and-hiring also replaces Eve with Ravana the rogue, as the doctor explains [PDF] here:

The statement Sita wants to send a message to Rama is inspired from the episode in Sundara Kanda (lit. beautiful book) of Ramayana, where Sita, who was kidnapped by Ravana, is isolated and kept confined to a forest. She is seated under an ashoka tree, when the monkey-God Hanuman, sent by Rama, reaches her. Desperate Sita wants to send a message to Rama through Hanuman (an honest man). We also have the usual man-in-the-middle Ravana (a rogue), who is waiting to sabotage any communication between Sita and Rama. In addition to the aptly chosen names, this entire episode has some striking similarities to modern cryptography. This choice is very effective in teaching cryptography, because the Ramayana story is widely known, and is retained in memory easily for a longer time.

Ditching Alice and Bob with Sita and Rama makes sense because the first letters of the latter pair's names, S and R, hint at sender and receiver respectively. The only disadvantage of the Hindu alternative is the name of Ravana, the man-in-the-middle, also begins with R, so there's potential confusion with receiver. Dr Parthasarathy acknowledges this point: "We propose Badmash (lit. bad man), although he is not part of Ramayana," he suggests.

The poetic Hindu alternative to traditional cryptography characters also has the benefit of adding Hanuman (honest man) as the trusted medium for carrying the message in a otherwise hostile environment. "When Hanuman approaches Sita and presents himself as Rama’s emissary, Sita does not believe him. She asks him to prove his credentials. Hanuman does this by presenting the ring which Rama usually wears. This may be compared to a digital certificate," Dr Parthasarathy added.

There are more neat analogies presented by the tale of Ramayana, and its application as a metaphor for cryptography. Dr Parthasarathy concluded:

Cryptography is a fairly complex subject. The number of entities involved, and the strategies they adopt are not easy to visualise. Teaching such a subject can be challenging, and requires the use of some innovative approaches and props. The "Alice and Bob" approach has a much better and more effective alternative: the "Sita and Rama" approach. Of course, analogies often involve some amount of exaggeration and distortion and limitations, and so, should be used with caution.

The Ramayana story may be widely known in India, but not in the West. Perhaps an alternative recasting could draw from Greek mythology - which, after all, lent the concept of the Trojan horse to information security. Maybe there's something in Jason and the Argonauts to forge an analogy to cryptography, though nothing immediately springs to mind.

Looking further afield, modern cryptographic technology essentially relies on complex mathematics, and Persian and Arab scholars made huge early contributions to the abstract science. As a tip of the hat, we could do worse than draw on Middle East folk tales and recast Bob as Aladdin and Alice as Princess Badroulbadour (perhaps better known as Princess Jasmine thanks to Disney) together with Ali Baba as the information-intercepting rogue. Admittedly we're mixing up characters from different yarns here.

Reg readers are invited to come up with their own analogies.

The storied history of Alice and Bob is explained by crypto-guru Bruce Schneier in this video. Eve's alternative point of view is illustrated in this XKCD cartoon strip. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.