3 ms·
I agree - all security is assembled from lower level primitives and can be insecure despite using good building blocks. AES (even AES-128) is a fine choice, ECB
by rzimmerman 7y ago
I agree - all security is assembled from lower level primitives and can be insecure despite using good building blocks. AES (even AES-128) is a fine choice, ECB mode is even okay in some contexts, but using that a stream cipher is not appropriate.
- noahtallen 7y agoDefinitely. Some other places (I think Telegram iirc) do actually create their own encryption algorithms without using existing ones. That’s what I thought rolling your own crypto scheme was. If the problem with Zoom is that they chose a poor mode for the algorithm, why doesn’t the headline say that? Creating your own encryption algorithm is way worse. If rolling your own encryption scheme is just choosing what algorithm you use — every system does that. So it’s not headline worthy. :/ I get that zoom needs to make better choices, but the rhetoric around it has been pretty poor and unhelpful.