3 ms·
Then why give specifics at all? Why not say something like "use industry best practices for encryption" or equivalent legalese?
by thayne 6y ago
Then why give specifics at all? Why not say something like "use industry best practices for encryption" or equivalent legalese?
- fogihujy 6y agoBest practice most likely wasn't good enough back when the original text was written. But yeah, they should have made it a bit more future-proof, and they definitely shouldn't have copy/pasted the text into new treaties 12 years later.
- piaste 6y agoBecause there isn't a Big Book of Industry Best Practices everybody can trivially agree to use? Sometimes they don't exist - who maintains a sufficiently reputable list of safe email clients and web browsers? Sometimes they exist but they carry some baggage - the FIPS standards for cryptography are probably fine, certainly better than hardcoding a couple of algorithm names, but they're also controlled by a foreign government.
- colejohnson66 6y agoWasn’t “best practice” back then MD5 even though it was known to be insecure?
- deleted 6y ago[deleted]