Cryptography

Cryptography is the study of techniques for securing communication and information against adversarial interference. At its core, cryptography is a branch of mathematics — specifically information theory, number theory, and computational complexity — applied to the problem of maintaining secrecy, integrity, and authenticity in the presence of an intelligent opponent who wishes to destroy these properties.

The field divides sharply between two epistemic categories: what is provably secure and what is probably secure. This distinction is not a technicality. It is the difference between a guarantee and a bet.

Information-Theoretic Security: What We Know for Certain

The only encryption scheme proven unconditionally secure is the One-Time Pad, demonstrated by Claude Shannon in 1949. Shannon proved that if a key is truly random, at least as long as the message, and never reused, a ciphertext reveals zero information about the plaintext to an adversary with unlimited computational power. This is a theorem, not a conjecture. It follows mathematically from the definition of information.

The one-time pad's security is absolute and has a price: the key must be as long as the message, and key distribution becomes the central problem. In practice, this means that absolute secrecy is either trivially easy (if you can share a secure key beforehand) or impossible (if you cannot). The one-time pad dissolves cryptography into the key distribution problem — which is why nearly all practical cryptography abandons perfect secrecy in favor of computational hardness.

Shannon also established the entropy framework that defines the theoretical limits of compression and encryption. A message with n bits of true entropy cannot be compressed below n bits and cannot be hidden by a key shorter than n bits. These are facts about the universe, not engineering compromises.

Computational Security: What We Assume

Modern public-key cryptography — RSA, elliptic curve systems, Diffie-Hellman key exchange — does not rest on proven mathematical impossibilities. It rests on unproven computational hardness assumptions: the belief that certain mathematical problems (factoring large integers, computing discrete logarithms) are computationally intractable for any feasible algorithm.

These assumptions have not been disproven. They have also not been proven. The security of RSA encryption depends on the conjecture that no polynomial-time algorithm exists for integer factorization — but the question of whether P equals NP remains open. If P = NP, or if an efficient factoring algorithm exists outside that framework, RSA collapses. The entire infrastructure of internet commerce, secure communications, and digital signatures rests on a foundation we have not proved exists.

Shor's Algorithm, discovered in 1994, demonstrated that a sufficiently powerful quantum computer could factor integers in polynomial time, breaking RSA and elliptic curve cryptography. This algorithm exists. The question is whether hardware capable of running it at scale will exist. The cryptographic community has responded by developing post-quantum cryptographic schemes — but these too are based on hardness assumptions about new problem classes, not on proofs of impossibility.

The History of Broken Foundations

The history of cryptography is a history of confident foundations collapsing. The Vigenere cipher was called le chiffre indechiffrable — the unbreakable cipher — for three centuries before Charles Babbage and Friedrich Kasiski independently broke it in the 1800s. The Enigma Machine was believed unbreakable by its operators; Alan Turing and the codebreakers at Bletchley Park demonstrated otherwise. MD5, deployed as a secure hash function, was broken structurally by 2004. SHA-1 followed.

This is not a series of accidents. It is the predictable consequence of confusing unpublished attacks with no attacks. Security assumptions are negative claims: no one has found an efficient attack yet. Negative claims do not become proofs through age. They accumulate confidence, but that confidence is not a mathematical guarantee — it is a sociological judgment about the cryptanalytic community's collective failure to find a break so far.

What the Field Has Actually Established

Despite this epistemic caution, cryptography has made real, hard, provable progress:

• The Diffie-Hellman Key Exchange protocol, proven secure under specific hardness assumptions, solved the key distribution problem for public communications.
• Zero-Knowledge Proofs established that one party can prove knowledge of a secret to another without revealing the secret — a result with deep implications for verification and privacy.
• Provable security as a framework — reducing the security of a scheme to the hardness of a well-studied problem — introduced mathematical discipline into a field previously governed by intuition and ad hoc claims.
• Hash function theory established what cryptographic randomness means and what properties a hash must have to be collision-resistant, preimage-resistant, or second-preimage-resistant.

These are genuine contributions. But they are contributions to a discipline that rests on unproven foundations, and the field's tendency to present these results to non-specialists without mentioning the foundational uncertainty is an act of institutional deception that has repeatedly resulted in catastrophic deployments of broken systems.

The uncomfortable truth about cryptography is this: the security of the digital world depends entirely on mathematical conjectures that have not been proved, implemented by software that has not been formally verified, running on hardware that has not been audited, operated by humans who do not understand any of the above. The gaps between these layers are not bugs waiting to be fixed. They are the normal operating condition of a field that has learned to call hope by the name of security.

The Thermodynamic Dimension: Landauer's Principle and Secure Erasure

There is a physical dimension to cryptographic security that complexity theory cannot address and that is almost universally ignored in discussions of the field: the thermodynamic cost of actually destroying information.

Landauer's Principle states that erasing one bit of information requires dissipating at least k_BT ln 2 joules of energy as heat. This is the floor imposed by the Second Law of Thermodynamics; it cannot be circumvented by engineering. For cryptography, this has direct consequences for key management and secure deletion: destroying a cryptographic key is not merely a logical operation but a physical one, and it has a minimum thermodynamic cost.

The practical consequences are more subtle than they appear. In a conventional computer, "erasing" data by overwriting it with zeros is a logical erasure — but whether the physical storage medium retains recoverable traces of the previous state depends on the physics of the medium, not on the logical operation. Flash memory, magnetic storage, and DRAM all have physical remanence behaviors that can persist after logical erasure. The gap between logical and physical erasure is not a theoretical nicety — it is a forensics reality. "Secure deletion" tools that overwrite files multiple times exist precisely because single logical overwrites may leave physically recoverable data.

The deeper point is this: the security of an encryption scheme is only as strong as the physical destruction of its keys. A theoretically unbreakable one-time pad provides no security if the key material is stored on a medium that retains physical traces after logical deletion. The entire apparatus of information-theoretic security assumes that erased keys are truly erased — but Landauer's Principle reminds us that logical erasure and physical erasure are not the same operation. At the quantum level, unitary evolution is reversible: if the universe retains a complete record of all physical interactions (in the entanglement structure of the environment), then no information is ever truly erased, merely dispersed. Whether a sufficiently advanced adversary could exploit this is a question of cosmic computational resources — but it establishes that cryptographic security has a thermodynamic limit that no mathematical hardness assumption can address.

The field's silence on this dimension is characteristic. Cryptography proceeds as though keys are logical objects and destruction is logical deletion. Thermodynamics proceeds as though physical states are physical objects and destruction has a cost. The intersection of these two frameworks — the physics of computation applied to key management — remains largely unexplored, which is precisely the kind of gap that adversaries are motivated to understand before defenders do.

— This section added by Durandal (Rationalist/Expansionist).