Trust, but Verify: home

An exhibition in Moscow

Trust, but Verify

SHA-256 of the title a76ddf256054d1f0415e2abe854ce81b05f42232e8e8d546f91caeeb3a39a38c

The exhibition that verifies you

Where
ZILART Museum and Exhibition Centre
3 Bratyev Vesninykh Blvd, Moscow
When
[DATES]
Hours
Tue–Sun 10:00–22:00
Brochure
Download PDF (in Russian) 491.9 KB

The idea

Trust, but verify.

A museum and a security team do the same job. A conservator X-rays a painting to see what lies under the paint. A cryptographer checks a signature to learn who really sent the message. And each of us decides ten times a day whether this email, this call, this face on the screen is real.

Artists learned to hide, to forge and to expose long before computers. Holbein hid a skull in a state portrait, van Meegeren sold museums a “Vermeer” he had painted himself, and a sculpture in the courtyard of the CIA has kept an unsolved cipher for thirty-five years. In this exhibition every artwork stands next to its digital twin: the trick the artist used, and the same trick in code.

Four rooms ask the four questions every security system asks: Who are you? Is it real? Who is watching? What if it breaks? Take a passport at the entrance. Each room holds one check. Pass all four and you leave with a certificate of authenticity — your own.

Cyber means helmsman

Greek κυβερνήτης is the helmsman, the one who steers the ship. In 1948 Norbert Wiener named the science of control and communication “Cybernetics”. Cybersecurity grew out of that word.

physicstoday.aip.org

A proverb the world knows in Russian

Signing the INF Treaty on 8 December 1987, Ronald Reagan said it in Russian: “Doveryai, no proveryai.” Mikhail Gorbachev replied: “You repeat that at every meeting.” In 2010 Forrester analyst John Kindervag turned the same idea into the Zero Trust security model: trust no one by default, verify every request.

en.wikipedia.org, reaganlibrary.gov, isc2.org

This is the fingerprint of the title

The 64 characters under the title are its SHA-256 fingerprint. Change one letter and everything changes. This is how a computer checks that a file was not swapped.

a76ddf256054d1f0415e2abe854ce81b05f42232e8e8d546f91caeeb3a39a38c

Four rooms, four questions

Room 02 · authenticity and forgery

Is it real?

A forgery is betrayed by one detail that could not be there: a pigment from the wrong century in a painting, one wrong letter in an email address.

Room 02 in full

Room 03 · secrecy, ciphers, surveillance

Who is watching?

Hiding a message in plain sight is the oldest art and the oldest technology. Without the key a cipher looks like noise; with it, like text.

Room 03 in full

Room 04 · error, noise, chance

What if it breaks?

Chance makes art alive and keys strong. An error can be glitch art or a vulnerability: it depends on who finds it.

Room 04 in full

The verification passport

Take a passport at the entrance. Each room holds one check: solve it, write the answer and take a stamp.

The answers change every day and are checked only at the bureau. They are not on this site and never will be.

  1. Check 1 Room 01. Who are you?

    Find today's password in the password book (it is on the sign next to it). Write the page number.

    A popular password is a public password.

  2. Check 2 Room 02. Is it real?

    Compare the hash on today's card with the hashes under pictures A–D. Write the letter of the original.

    The eye sees no difference; the hash does. One dot changes everything.

  3. Check 3 Room 03. Who is watching?

    Decrypt today's word on panel 03/04 with the Vigenère table. Key: КОРМЧИЙ.

    Without the key a cipher is noise; with it, text.

  4. Check 4 Room 04. What if it breaks?

    Take a portrait in the photo booth and copy the word from the bottom line of the receipt.

    Data does not have to be kept, and that is fine.

Verification Bureau

Four stamps? Come to the desk. We check your answers and issue a certificate of authenticity in your name. We do not keep your name.

How to get the certificate

  1. Show your passport with the stamps.
  2. Say the name for the certificate.
  3. Take the certificate. The name is erased right after printing.

A card about you

Draw one number about yourself on a card: how many passwords you have, how often you pick up your phone. Pin it to the wall. By the end of the show it becomes a shared work.

Signal

Seven letters hide under red noise along the route. Look at the noise through the red window of your passport and collect the word.

The passport cover has a red window cut into it. It is a light filter: it lets through red light only.

The noise is printed in red ink, the letter beneath it in cyan. Through the filter red merges with the background and cyan turns dark. The noise disappears, the letter stays.

Collect the letters in the order of the route and write the word in your passport. Which word? You will find out only in the rooms.

Signal A bonus, not a condition: you get the certificate without it.

A noise field and the 45 × 30 mm window. We do not show the letters here.

A glitch that works

Every QR code in this exhibition is damaged, up to a quarter of its modules. It still works: the code carries redundancy and can lose 30 %. That is how resilience works, in QR codes and on the internet. The QR codes on the labels lead to the pages of this site, one for each pair.

Opening programme

Date: [DATES]. Times count from the start of the evening.

  1. 00:00Opening: Foma and the museum
  2. 00:15Free walk-through
  3. 01:00Talks: rooms 01 and 02
  4. 01:45Game: Original or fake?
  5. 02:00Talks: rooms 03 and 04
  6. 02:45Bureau, certificates, group photo

Room talks

  • Room 01 Why a face is a bad password: authentication from the signet ring to passkeys How many seconds a password from the audience survives
  • Room 02 Social engineering: 130 years of one script A game with the audience: “Original or fake?”
  • Room 03 From Caesar to end-to-end encryption in 15 minutes The audience cracks a Caesar cipher together in a minute
  • Room 04 A bug is a glitch someone exploited Rolling a lava dice on screen

Curators

Curator and producer of the exhibition
Foma Molchanov
Room 01 curator
[КУРАТОР ЗАЛА 01]
Room 02 curator
[КУРАТОР ЗАЛА 02]
Room 03 curator
[КУРАТОР ЗАЛА 03]
Room 04 curator
[КУРАТОР ЗАЛА 04]

We keep nothing

  • No attacks on visitors' devices or the museum network; demos run only on our own laptops.
  • The interactives store nothing: no passwords, no faces, no names.
  • The passwords in the book come from the public RockYou training list, without logins or addresses.
  • This site too: no cookies, no counters or analytics, no third-party servers. The fonts are served alongside the pages.

Three things to do tonight

  • Turn on two-factor authentication for your email and messenger.
  • Check the sender's address before you click a link.
  • Update your system and apps tonight.