4 ms·
> something like Dual_EC_DRBG being submitted in bad faith. That's a poor example, because everyone (who both knew anything about cryptography and actually bot
by a1369209993 5y ago
> something like Dual_EC_DRBG being submitted in bad faith.
That's a poor example, because everyone (who both knew anything about cryptography and actually bothered to read it) knew or suspected it was garbage. As [0] put it:
> > and Dual_EC_DRBG was an accepted and publicly scrutinized standard.
> And every bit of public scrutiny said the same thing: this thing is broken!
0: https://blog.cryptographyengineering.com/2013/09/20/rsa-warns-developers-against-its-own/ https://blog.cryptographyengineering.com/2013/09/20/rsa-warn...
see also: https://blog.cryptographyengineering.com/2013/09/18/the-many-flaws-of-dualecdrbg/ https://blog.cryptographyengineering.com/2013/09/18/the-many...
- acdha 5y agoTrue: the angle I was focusing on is the demonstrated interest and willingness to spend time and credibility on it (see also Crypto AG). It’s safe to assume that will continue as society moves further online so we should assume well-funded concealed attempts to compromise implementations will continue.
- a1369209993 5y ago> the angle I was focusing on is the demonstrated interest and willingness to spend time and credibility on it Ah, fair enough. My point was that it's at least not demonstated, if not not true, that you need a lot of adversarial research to prevent something like Dual_EC_DRBG (specifically) being submitted in bad faith - you just need to actually bother to read the crypto specification you're considering adopting, and have the bare minimum competence to notice that there's no benefit to a number-theoretic design besides the ability to prove security relative to some presumed-hard task, and that there is no such proof.