3 ms·
How? I honestly don't follow your logic at all.
by kop316 8y ago
How? I honestly don't follow your logic at all.
- toast0 8y agoTreating a certification of algorithm correctness as a certification of a well engineered product is a poor choice, because many security critical things in the product are not considered in the certification.
- kop316 8y agoThat makes a lot of sense, thank you! I got the impression that the parent comment meant that the certification itself means nothing, hence my confusion.
- toast0 8y agoI mean; a crypto certification that doesn't tell you very much about the effective security of the product doesn't provide very much value though, does it? All it tells me, is that someone thought it would increase their sales enough to justify the time and money; they may not have spent time and money to generate random numbers properly, and may just use 4 all the time; they could probably still get a fips cert, because it's out of the scope of the certification.
- tptacek 8y agoPretty much, yep.
- SmallDeadGuy 8y agoIn this SSD case, if they only certified the algorithm then all the SSDs would be fine (probably). The encryption itself is probably good and wouldn't be easily broken if you only had access to the encrypted data. It's the key generation and usage outside of the algorithm that is broken in these drives.