5 ms·
Point noted. I don't review cryptosystems for a living. I guess my point was that most of the cryptosystems /I've/ used over the years have seen significant v
by Nrsolis 16y ago
Point noted. I don't review cryptosystems for a living.
I guess my point was that most of the cryptosystems /I've/ used over the years have seen significant vulnerabilities exposed in key management and side channel attacks. Insufficient entropy for key generation is another one. That said, I probably benefit from people like you weeding out the REALLY bad implementations.
I do agree that you're likely to see a lot of extraordinarily poorly designed cryptosystems if you regularly look at work product from people who are unfamiliar with attack methodologies in general.
- tptacek 16y agoI work in app security, and maybe 1% of the testers I know (I know a lot of testers) are familiar with crypto attack methodologies. It's still a dark art. I don't know where a company that wasn't "plugged in" would ever find expertise.