3 ms·

Per the blog post and challenge text: "We are issuing this challenge because we are confident that no one will succeed. In fact, we know no one will succeed – s

by jnoller 16y ago

Per the blog post and challenge text: "We are issuing this challenge because we are confident that no one will succeed. In fact, we know no one will succeed – security experts will realize that this “challenge” is really more of a demonstration. This is a stunt to bring attention to the strength in modern encryption and our use of it. In reality, encryption is the least likely place to fail in a secure system. The smart attacker will know to avoid the crypto and to look for weaknesses elsewhere (frequently in people and IT processes)." We fully acknowledge and concur with Schneier.

tptacek 16y ago
As an attacker of middling intelligence, crypto is the place I look first in custom designs for failures, because lay developers are absolutely awful at deploying it. Your stunt harms end-user understanding of how security works.
- rdl 16y ago
  As an attacker of (...) intelligence, key management is the place I look first in security protocols for failures, because both lay developers and crypto engineers tend to make more mistakes there than anywhere else in crypto protocols.
  - tptacek 16y ago
    More than half of the crypto schemes I've looked at in the last 2 years have used ECB mode. Of the very few systems that used CTR mode, two of them had colliding nonces. Less than half of the systems I see have explicit MACs. Some of the most popular systems in the world have had padding oracles (see the recent drama around JSF, and note SSH fell to this too). Three SRP systems I've had to evaluate have had the (thanks, Nate and Trevor) zero-mod-n problem. Nate and Coda Hale have found multiple famous systems, with HMAC MACs, that are trivially timeable. No. Key management isn't the problem. Key management is what people bring up when they mean "I haven't really looked at the underlying crypto very carefully". It's a punt answer that leaves people feeling warm and fuzzy about actual cryptography, when actual cryptography is likely as not to be the thing that actually kills you.

by jnoller 16y ago

tptacek 16y ago

As an attacker of middling intelligence, crypto is the place I look first in custom designs for failures, because lay developers are absolutely awful at deploying it. Your stunt harms end-user understanding of how security works.

rdl 16y ago
As an attacker of (...) intelligence, key management is the place I look first in security protocols for failures, because both lay developers and crypto engineers tend to make more mistakes there than anywhere else in crypto protocols.
- tptacek 16y ago
  More than half of the crypto schemes I've looked at in the last 2 years have used ECB mode. Of the very few systems that used CTR mode, two of them had colliding nonces. Less than half of the systems I see have explicit MACs. Some of the most popular systems in the world have had padding oracles (see the recent drama around JSF, and note SSH fell to this too). Three SRP systems I've had to evaluate have had the (thanks, Nate and Trevor) zero-mod-n problem. Nate and Coda Hale have found multiple famous systems, with HMAC MACs, that are trivially timeable. No. Key management isn't the problem. Key management is what people bring up when they mean "I haven't really looked at the underlying crypto very carefully". It's a punt answer that leaves people feeling warm and fuzzy about actual cryptography, when actual cryptography is likely as not to be the thing that actually kills you.