2 ms·
How can you prove a vulnerability isn't deliberate? We've seen deliberate security vulnerabilities before (DUAL_EC).
by alexandercrohde 9y ago
How can you prove a vulnerability isn't deliberate?
We've seen deliberate security vulnerabilities before (DUAL_EC).
- lima 9y agoYou can't, but let me point out that DUAL_EC was a "nobody but us" backdoor that required their private key to use. (and yes, it backfired) If they're introducing regular vulnerabilities, they're also making themselves vulnerable, given that the US government is one of the biggest Intel customers.
- ComputerGuru 9y agoI remember back in the good old days of cryptography export restrictions when the NSA had a much simpler "nobody but us" approach: you encrypted data with a xx-bit private key, half of which was shared with the NSA. Should they need to break content, the other half of the key could be brute-forced at costs that were economically feasible (for targeted use, not blanket suviellance) to the NSA but the full-length key would be unbreakable (in theory) by anyone without prior knowledge of that other half.