3 ms·

A few years back someone was writing software that did potentially illegal things, like more than 40 bits of crypto, which was illegal when distributed outside

by bb88 6y ago

A few years back someone was writing software that did potentially illegal things, like more than 40 bits of crypto, which was illegal when distributed outside of the US (maybe still is). Their response was: "It's completely legal as distributed. Look at the header and you'll see: #define CRYPTO_LENGTH 40 "

deleted 6y ago
[deleted]
bArray 6y ago
I believe it was something to this affect that prevented us from implementing decent crypto for vehicles. There was some rule about export (possibly to the US or out of the US) that meant there was a limitation on how secure we could make the software. As a result, everybody ended up getting the same shitty low-security version of the product worldwide (they wanted to limit the number of variations for test coverage).
- jtbayly 6y ago
  That sounds like a win for vehicle owners, honestly, given that encryption is often used for locking owners out of the ability to change things about their car without paying the manufacturer more money.
  - bArray 6y ago
    You might think so, but the encryption used at the time was such that only somebody with quite a few resources (such as a government actor) could reasonably break the encryption. It wasn't a win for owners or tinkerers. What's more worrying is that there are a bunch of vehicles out there with security that is going to age * very * fast compared to that used every day (SSH, certs, etc). Consider that the automotive industry might be under similar constraints with regards to autonomous vehicles, something a bad actor could really cause some damage with.
userbinator 6y ago
"If you outlaw encryption, only outlaws will have encryption."
- u801e 6y ago
  While a variation of that statement is used in defense of the Second Amendment of the US Constitution, some people have thought of how the second amendment might apply to cryptography[1] [1] https://repository.uchastings.edu/cgi/viewcontent.cgi?article=1001&context=hastings_science_technology_law_journal https://repository.uchastings.edu/cgi/viewcontent.cgi?articl...

by bb88 6y ago

deleted 6y ago

[deleted]

bArray 6y ago

I believe it was something to this affect that prevented us from implementing decent crypto for vehicles. There was some rule about export (possibly to the US or out of the US) that meant there was a limitation on how secure we could make the software. As a result, everybody ended up getting the same shitty low-security version of the product worldwide (they wanted to limit the number of variations for test coverage).

jtbayly 6y ago
That sounds like a win for vehicle owners, honestly, given that encryption is often used for locking owners out of the ability to change things about their car without paying the manufacturer more money.
- bArray 6y ago
  You might think so, but the encryption used at the time was such that only somebody with quite a few resources (such as a government actor) could reasonably break the encryption. It wasn't a win for owners or tinkerers. What's more worrying is that there are a bunch of vehicles out there with security that is going to age * very * fast compared to that used every day (SSH, certs, etc). Consider that the automotive industry might be under similar constraints with regards to autonomous vehicles, something a bad actor could really cause some damage with.

userbinator 6y ago

"If you outlaw encryption, only outlaws will have encryption."

u801e 6y ago
While a variation of that statement is used in defense of the Second Amendment of the US Constitution, some people have thought of how the second amendment might apply to cryptography[1] [1] https://repository.uchastings.edu/cgi/viewcontent.cgi?article=1001&context=hastings_science_technology_law_journal https://repository.uchastings.edu/cgi/viewcontent.cgi?articl...