3 ms·

I find it amusing that the line before your statement of distrust around GPG refers to using that bastion of solid, dependable crypto code that ships with OpenS

• nickpsecurity 10y ago
  That was pretty funny. Gets better with the Snowden slides where mighty NSA basically says they can't break it in basic, use case. At Princeton, Snowden even said analysts got failure notices even for requests to decrypt GPG w/ 1,024-bit RSA at a time when paranoids wondered how long 4,096-bit might last. Haha. Next I'm going to hear that using TAIL's increases your risk of damning evidence found during a disk audit by a forensics team.
• cperciva 10y ago
  OpenSSL's crypto code isn't all that bad as long as you're not worried about side channel attacks. Most of their remote code execution bugs have been in protocol code.
  • cyphar 10y ago
    > OpenSSL's crypto code isn't all that bad as long as you're not worried about side channel attacks. I consider "horrible API that makes it basically impossible to write safe code" to be a security vulnerability. Not to mention that OpenSSL's example code actually had security vulnerabilities (they didn't check the return value from one of the IV routines, whish means that you could end up using a shorter key than you expected).