5 ms·

This seems like a good explanation to me, thanks! One question though - why have the EU texts themselves not been updated since 2008?

volta87 6y ago
Probably because legislators have better things to do.
foepys 6y ago
No need. The intend is clear and there are more important things to do.
kqvamxurcagg 6y ago
In reality more modern communication techniques will be in use now. The legislation is in effect setting a minimum standard for implementation.
thayne 6y ago
Better question, why was it not written so it could be updated by security experts without requiring new legislation.
- evgen 6y ago
  Because it is not necessary. The actual parties involved know what is meant and intended, so adding some ongoing and constant amendment process is counter-productive.
  - SV_BubbleTime 6y ago
    > The actual parties involved know what is meant and intended Trying to keep lawyers in business it sounds like. “Intent” is one of the trickiest things in the world when you want it to be.
  - tyxodiwktis 6y ago
    Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. I have worked on govt projects where we had to downgrade to an insecure cipher suite to comply with outdated regulations. Putting on my govt contractor hat, there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. Could charge a pretty penny too - it’ll all get budgeted as “Brexit compliance” costs.
    - Natsu 6y ago
      > Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. That reminds me of FIPS for some reason...
    - sonotmyname 6y ago
      > there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. The text quoted in the linked article in no way mandates the use of Netscape Navigator or Mozilla Mail - it merely references them as being widely distributed software capable of using RSA 1024 and SHA-1 (which it does appear to mandate).
      - colejohnson66 6y ago
        It does mention AES-256. The pairing of that with SHA-1 and RSA-1024 is peculiar.
  - thayne 6y ago
    Then why give specifics at all? Why not say something like "use industry best practices for encryption" or equivalent legalese?
    - fogihujy 6y ago
      Best practice most likely wasn't good enough back when the original text was written. But yeah, they should have made it a bit more future-proof, and they definitely shouldn't have copy/pasted the text into new treaties 12 years later.
    - piaste 6y ago
      Because there isn't a Big Book of Industry Best Practices everybody can trivially agree to use? Sometimes they don't exist - who maintains a sufficiently reputable list of safe email clients and web browsers? Sometimes they exist but they carry some baggage - the FIPS standards for cryptography are probably fine, certainly better than hardcoding a couple of algorithm names, but they're also controlled by a foreign government.
    - colejohnson66 6y ago
      Wasn’t “best practice” back then MD5 even though it was known to be insecure?
      - deleted 6y ago
        [deleted]
- brigandish 6y ago
  Acts and regulations (to use the UK legal parlance) perform different functions. Legislators will write a law (primary legislation) via an Act (of parliament) and powers are delegated to a regulator (or minister) who will then set regulations (secondary legislation) that fit within the power of the Act. The secondary legislation is the bit that can be updated without requiring a new Act. If EU law is set up in the same manner, (and no doubt it will be similar as not only is this method good when meeting the ideal but useful for corrupt politicians to write law with less scrutiny) then the copy and paste is from secondary legislation. It may well need an update but that doesn't mean it can't be updated in the manner you advocate. https://en.wikipedia.org/wiki/Delegated_legislation_in_the_United_Kingdom https://en.wikipedia.org/wiki/Delegated_legislation_in_the_U...
- Ekaros 6y ago
  That really brings question will all of those experts be trusted? Or might they be swayed by a hostile party like NSA? So the updated version would be more insecure than the existing one...
  - xxpor 6y ago
    It's not even a question of being swayed. I don't know about the process in the UK, but regulation writing is so slow in the US that being FIPS compliant usually means you're actually less secure since you're behind the latest in security.
thesuitonym 6y ago
Law moves slowly, this is a feature, not a bug.

volta87 6y ago

Probably because legislators have better things to do.

foepys 6y ago

No need. The intend is clear and there are more important things to do.

kqvamxurcagg 6y ago

In reality more modern communication techniques will be in use now. The legislation is in effect setting a minimum standard for implementation.

thayne 6y ago

Better question, why was it not written so it could be updated by security experts without requiring new legislation.

evgen 6y ago
Because it is not necessary. The actual parties involved know what is meant and intended, so adding some ongoing and constant amendment process is counter-productive.
- SV_BubbleTime 6y ago
  > The actual parties involved know what is meant and intended Trying to keep lawyers in business it sounds like. “Intent” is one of the trickiest things in the world when you want it to be.
- tyxodiwktis 6y ago
  Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. I have worked on govt projects where we had to downgrade to an insecure cipher suite to comply with outdated regulations. Putting on my govt contractor hat, there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. Could charge a pretty penny too - it’ll all get budgeted as “Brexit compliance” costs.
  - Natsu 6y ago
    > Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. That reminds me of FIPS for some reason...
  - sonotmyname 6y ago
    > there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. The text quoted in the linked article in no way mandates the use of Netscape Navigator or Mozilla Mail - it merely references them as being widely distributed software capable of using RSA 1024 and SHA-1 (which it does appear to mandate).
    - colejohnson66 6y ago
      It does mention AES-256. The pairing of that with SHA-1 and RSA-1024 is peculiar.
- thayne 6y ago
  Then why give specifics at all? Why not say something like "use industry best practices for encryption" or equivalent legalese?
  - fogihujy 6y ago
    Best practice most likely wasn't good enough back when the original text was written. But yeah, they should have made it a bit more future-proof, and they definitely shouldn't have copy/pasted the text into new treaties 12 years later.
  - piaste 6y ago
    Because there isn't a Big Book of Industry Best Practices everybody can trivially agree to use? Sometimes they don't exist - who maintains a sufficiently reputable list of safe email clients and web browsers? Sometimes they exist but they carry some baggage - the FIPS standards for cryptography are probably fine, certainly better than hardcoding a couple of algorithm names, but they're also controlled by a foreign government.
  - colejohnson66 6y ago
    Wasn’t “best practice” back then MD5 even though it was known to be insecure?
    - deleted 6y ago
      [deleted]
brigandish 6y ago
Acts and regulations (to use the UK legal parlance) perform different functions. Legislators will write a law (primary legislation) via an Act (of parliament) and powers are delegated to a regulator (or minister) who will then set regulations (secondary legislation) that fit within the power of the Act. The secondary legislation is the bit that can be updated without requiring a new Act. If EU law is set up in the same manner, (and no doubt it will be similar as not only is this method good when meeting the ideal but useful for corrupt politicians to write law with less scrutiny) then the copy and paste is from secondary legislation. It may well need an update but that doesn't mean it can't be updated in the manner you advocate. https://en.wikipedia.org/wiki/Delegated_legislation_in_the_United_Kingdom https://en.wikipedia.org/wiki/Delegated_legislation_in_the_U...
Ekaros 6y ago
That really brings question will all of those experts be trusted? Or might they be swayed by a hostile party like NSA? So the updated version would be more insecure than the existing one...
- xxpor 6y ago
  It's not even a question of being swayed. I don't know about the process in the UK, but regulation writing is so slow in the US that being FIPS compliant usually means you're actually less secure since you're behind the latest in security.

thesuitonym 6y ago

Law moves slowly, this is a feature, not a bug.