4 ms·

Werner Koch (see previous announcements) isn't a cryptography amateur.

by gnufx 8y ago

tptacek 8y ago
What exactly makes you say that? What cryptosystems has he designed? What has he published? He's the maintainer of the most important tooling for an older cryptosystem, sure. But, by way of comparison, not everyone who works on a TLS stack for a major OS is a cryptography expert. I actually don't know whether he is or he isn't an expert, but the likely basis for the claim that he is --- maintainer of GnuPG --- isn't a valid one. People have funny ideas of where crypto expertise comes from. (Disclaimer, or something: I consistently and reliably tell clients that while I'm comfortable testing certain cryptosystems, I am not qualified to design them. ['lvh, one of my partners, is, but he has formal training and I don't.])
- gnufx 8y ago
  I said it because he does cryptography implementation professionally, if perhaps for insufficient reward. I'm sorry that's used to cast aspersions about him by attacking something I didn't say. Why exactly is Koch not qualified to consult on applications of OpenPGP as the main author of GnuPG (which I guess Purism are actually using)?
  - tptacek 8y ago
    As I said, lots of people do cryptography implementation work professionally without being cryptography experts. In fact, I think that probably describes most implementors. So you haven't answered my question or supported the claim you made earlier.
bcaa7f3a8bbc 8y ago
which announcement? I searched "amateur" and only found two posts, my post and my parent post. edit: okay, found. https://puri.sm/posts/purism-and-nitrokey-partner-to-build-purekey-for-purisms-librem-laptops/ https://puri.sm/posts/purism-and-nitrokey-partner-to-build-p... This parent comment looks like a refutation. But the entire thread never claimed Werner Koch was an "amateur", and in fact didn't even mention him, so I don't know what is the point of the parent comment. If it's not a refutation, but making a point about its security, it is better to phrase positively, "Werner Koch is an expert", to make the point clear.
- gnufx 8y ago
  OK. It was meant to be reassuring and should have been prefixed with "However," or something.
- simcop2387 8y ago
  in my case, being the GPP, I was talking about myself being an amateur rather than making a judgement on anyone else.

Werner Koch (see previous announcements) isn't a cryptography amateur.

by gnufx 8y ago

Werner Koch (see previous announcements) isn't a cryptography amateur.

What exactly makes you say that? What cryptosystems has he designed? What has he published? He's the maintainer of the most important tooling for an older cryptosystem, sure. But, by way of comparison, not everyone who works on a TLS stack for a major OS is a cryptography expert. I actually don't know whether he is or he isn't an expert, but the likely basis for the claim that he is --- maintainer of GnuPG --- isn't a valid one. People have funny ideas of where crypto expertise comes from. (Disclaimer, or something: I consistently and reliably tell clients that while I'm comfortable testing certain cryptosystems, I am not qualified to design them. ['lvh, one of my partners, is, but he has formal training and I don't.])

gnufx 8y ago
I said it because he does cryptography implementation professionally, if perhaps for insufficient reward. I'm sorry that's used to cast aspersions about him by attacking something I didn't say. Why exactly is Koch not qualified to consult on applications of OpenPGP as the main author of GnuPG (which I guess Purism are actually using)?
- tptacek 8y ago
  As I said, lots of people do cryptography implementation work professionally without being cryptography experts. In fact, I think that probably describes most implementors. So you haven't answered my question or supported the claim you made earlier.

bcaa7f3a8bbc 8y ago

which announcement? I searched "amateur" and only found two posts, my post and my parent post. edit: okay, found. https://puri.sm/posts/purism-and-nitrokey-partner-to-build-purekey-for-purisms-librem-laptops/ https://puri.sm/posts/purism-and-nitrokey-partner-to-build-p... This parent comment looks like a refutation. But the entire thread never claimed Werner Koch was an "amateur", and in fact didn't even mention him, so I don't know what is the point of the parent comment. If it's not a refutation, but making a point about its security, it is better to phrase positively, "Werner Koch is an expert", to make the point clear.

gnufx 8y ago
OK. It was meant to be reassuring and should have been prefixed with "However," or something.
simcop2387 8y ago
in my case, being the GPP, I was talking about myself being an amateur rather than making a judgement on anyone else.