HomeWorksInfo
ContactBlog</>
en/blog/kyber/el-saber-y-el-hacer/
✕

Knowing and Doing — The Distance of the Secret — VI

By Xscriptor — Óscar Preciado6 min read
PhilosophyTechnologyCryptographyEssaycryptographypost-quantumKyberimplementationDartxkyber_cryptoepistemologyAristotleXscriptorÓscar Preciado
Knowing and Doing — The Distance of the Secret — VI

Knowing is not doing. Doing is not securing.


Aristotle distinguished three forms of knowledge. Episteme is theoretical knowledge — knowing that something is true. Techne is productive knowledge — knowing how to make something. Phronesis is practical wisdom — knowing what to do in a concrete situation.

Cryptography demands all three. And the distance between them is the space where most vulnerabilities occur.

Episteme: The Paper

Kyber is an achievement of episteme. The paper by Bos et al. (2018) describes a key encapsulation scheme based on Module-LWE, with security proofs, justified parameters, analysis of known attacks. It is theoretical knowledge in its most refined form: it defines, proves, concludes.

Reading the paper and understanding it produces the feeling of having captured something important. The structure is elegant: the matrix A is generated from a public seed, the secret s is sampled with a centered binomial distribution, the ciphertext is compressed to 3 bits per coefficient, the FO transform ensures IND-CCA2. Everything fits.

But episteme has a limit: the paper proves that if the components execute correctly, then the scheme is secure. The conditional proposition is true. But the real world does not evaluate conditionals; it executes code.

Episteme (the paper):  If (NTT correct ∧ constant time ∧ FO correct)
                       then the scheme is IND-CCA2 secure.

Techne (the code):     NTT correct? OK   Constant time? ?   FO correct? OK
                       The variable that does not appear in the premise
                       is what determines real security.

Techne: The Implementation

During my learning phase I implemented Kyber in Dart/Flutter — xkyber_crypto — following FIPS 203 to the letter. The techne of translating the paper into code has its own demands: choosing data representations, managing memory, implementing SHAKE128 from scratch, organizing polynomial multiplication in the NTT domain.

Each implementation decision reveals something the paper does not say:

The paper writes: "Sample s ← β_η^k"

The implementation writes:

void cbd(Poly r, Uint8List buf) {
  for (int i = 0; i < KYBER_N ~/ 8; i++) {
    int t = buf[2 * i] | (buf[2 * i + 1] << 8);
    for (int j = 0; j < 8; j++) {
      int aj = (t >> j) & 1;
      int bj = (t >> (j + 8)) & 1;
      r.coeffs[8 * i + j] = aj - bj;
    }
  }
}

The paper does not specify the bit order. It does not say whether the loop should be parallelizable. It does not mention that each access to r.coeffs[...] in Dart executes a bounds check that the VM cannot elide, and that each bounds check is an opportunity for time to vary.

The implementation was functionally correct. All test vectors passed. But techne revealed something that episteme could not: the language matters. Dart was not designed for high-assurance cryptography. There is no guarantee that the VM will compile a loop without data-dependent branching. There is no way to ensure that Montgomery reduction is constant-time when ~/ 65536 can be compiled as division or as a shift depending on the JIT optimization phase.

The ciphertext comparison in the FO transform — the most critical point — illustrates the abyss:

// Is this constant-time?
bool verify(Uint8List a, Uint8List b) {
  if (a.length != b.length) return false;
  int r = 0;
  for (int i = 0; i < a.length; i++) {
    r |= a[i] ^ b[i];
  }
  return r == 0;
}

In C, this function compiles to instructions that an expert can inspect and verify. In Dart, the JIT compiler can reorder the loop, merge iterations, apply dead code elimination if it deduces that r is not used, or insert GC barriers on writes. There is no volatile. There is no __attribute__((const)). There is no way to tell the VM: "this must execute exactly as written, without optimizations, without reordering, without surprises."

The techne of implementing Kyber in Dart encountered a material limit: the language does not provide the tools that cryptography demands.

Phronesis: The Archive

Having reached this point, phronesis — the practical wisdom of what to do — imposes a decision. The implementation works. The tests pass. But security is not demonstrated by passing tests: it is demonstrated by properties that are guaranteed.

There was no way to guarantee constant time in the Dart VM. There was no way to inspect the assembly generated by the AOT compiler to verify that loops remained branch-free. There was no way to ensure that the garbage collector would not introduce measurable pauses at the exact moment of the FO transform comparison.

The decision was to archive the repository. Not due to technical failure — the implementation was correct — but out of intellectual honesty:

The decision to archive:

  Does it work?                 Yes. The tests pass.
  Is it secure?                 Cannot be demonstrated.
  Can it be made secure?        Not without rewriting in C/Rust and linking via FFI.
  Does it provide value         Yes, as an example of how far
  as a reference?               techne goes without the proper infrastructure.

Aristotle wrote that phronesis is neither science nor art: it is the ability to deliberate well about what is good or bad for the human being. In cryptography, phronesis is knowing how to recognize when an implementation is insecure, even when all tests say it is correct.

What Doing Teaches

The series "The Distance of the Secret" has explored five distances:

  1. I: the distance between the LWE conjecture and the security proof
  2. II: the distance between the algorithm and its constant-time implementation
  3. III: the distance between computational security and the Landauer physical limit
  4. IV: the distance between present protection and future threat (harvest now)
  5. V: the distance between institutional trust and mathematical diversity

VI adds a more fundamental distance: the distance between knowing and doing.

The Kyber paper is true knowledge. The Dart implementation was productive knowledge. But real security — the kind that resists a real attack, not a unit test — requires something that neither provides alone: the ability to recognize that a system can be functionally correct and cryptographically insecure at the same time.

That is not learned in the paper. It is learned by implementing, failing, archiving.

With "Knowing and Doing" the cycle of "The Distance of the Secret" closes. The exploration began by asking when we can say that something is secure. The answer, after six essays, is: never completely. But we can get closer — combining the theory that proves, the practice that builds, and the wisdom that recognizes the limits of both.

Cross-references with the research:

✕