2 ms·
Again, no matter how secure you make the cryptography, the weakpoint is the key. Why would someone "tweak" a key, provide it to a "big commercial company" (who
by jfrunyon 6y ago
Again, no matter how secure you make the cryptography, the weakpoint is the key. Why would someone "tweak" a key, provide it to a "big commercial company" (who for some reason doesn't generate their own key?), instead of just keeping a copy of the key?
- elmo2you 6y ago> Why would someone "tweak" a key To make it look, at least to outsiders (be that users or researchers) like you are providing actually strong crypto. Leaking a key might not be as trivial as some people would imagine, with proper security policies in place. You are indeed right, in that the key is usually the weak point. But there are several ways in which that can be true, with rather different consequences. If a private key of big company show up in a place where should certainly not be, pandemonium would quickly ensue. On the other hand, a "tweaked" (intentionally weakened) key is a very different story. It will provide easy plausible deniability. It's also much easier to manage breaking larger collections of such keys (with a similar "flaw") without ever any hard evidence linking such keys together. Is it really that hard to understand/imagine? (sincere question)
- jfrunyon 6y agoWith proper security policies in place, creating a flawed key would also "not be as trivial as some people would imagine". The issue which you claimed is that one can not determine whether or not the other party is following proper security policies - which is true no matter what.