2 ms·
> They could be rightly suspicious of a western TLS implementation but discovered the pitfall of writing their own. Could have also been intentional. They coul
by manuelabeledo 3y ago
> They could be rightly suspicious of a western TLS implementation but discovered the pitfall of writing their own. Could have also been intentional.
They could have deployed TLS with some cipher of Chinese origin, not like Chinese companies haven't done this before [0]
[0] https://ciphersuite.info/cs/TLS_SM4_GCM_SM3/ https://ciphersuite.info/cs/TLS_SM4_GCM_SM3/
- lucubratory 3y agoIf there's a zero day that's been embedded in a protocol by the NSA or actively used by the NSA, I normally wouldn't expect it to come from the actual encryption process itself. It would be something that choosing your own cipher wouldn't fix, because it would be about compromising security on the software level rather than the encryption level. There's a very good reason the PRC won't allow compromised Cisco routers, it wouldn't surprise me if there was similar thinking here, justified or not.
- manuelabeledo 3y ago> … actively used by the NSA … So the NSA would purposefully embed an exploitable bug in a cipher they themselves use? > … it would be about compromising security on the software level rather than the encryption level Those are two very different things. A cipher could very well be exploitable. What you are talking about is the implementation. In other words, a vulnerable cipher would be exploitable regardless of the implementation. It is not the case, though. They tried to deploy their own protocol on top of a well known cipher.