3 ms·
Although you're right that anything but OTPs give you guarantees and that cryptography is still a black art (with lots of unrealistic conditional proofs), good
by jonathanstrange 7y ago
Although you're right that anything but OTPs give you guarantees and that cryptography is still a black art (with lots of unrealistic conditional proofs), good cryptography can be completely open and will be no less secure if it is published, so there is really no need to kidnap the cryptographer.
There is also good reason to assume that if e.g. you make your own Feistel cipher out of existing cryptographic primitives without caring too much about performance, then it will be secure enough against state actors.
Nowadays side channel attacks seem to be the rule, and there is no way to secure the endpoints without developing the whole technology in-house - which is essentially impossible even for organized crime. So the whole discussion is essentially moot, the FBI can buy 0-day exploits on the black market or develop their own like everyone else.
- backdoorsgalore 7y ago<< There is also good reason to assume that if e.g. you make your own Feistel cipher out of existing cryptographic primitives without caring too much about performance, then it will be secure enough against state actors. >> The key is "your own" By "public" I don't mean that their spec is "published" but that their implementation is open source and has various 3rd party contributions and dependencies, as is the case with most OSS. So if you build your own, and it's good against the NSA, they'd come after you if they have to, unless it costs them less to crack it. I agree ultimately with your assessment that side channel attacks make this whole discussion moot. But my original point was and still is: nothing is secure against a determined and well resourced adversary. So people out there shouldn't get the wrong idea that cryptography is an invisibility cloak or some such