3 ms·

If there's a zero day that's been embedded in a protocol by the NSA or actively used by the NSA, I normally wouldn't expect it to come from the actual encryptio

If there's a zero day that's been embedded in a protocol by the NSA or actively used by the NSA, I normally wouldn't expect it to come from the actual encryption process itself. It would be something that choosing your own cipher wouldn't fix, because it would be about compromising security on the software level rather than the encryption level. There's a very good reason the PRC won't allow compromised Cisco routers, it wouldn't surprise me if there was similar thinking here, justified or not.

manuelabeledo 3y ago
> … actively used by the NSA … So the NSA would purposefully embed an exploitable bug in a cipher they themselves use? > … it would be about compromising security on the software level rather than the encryption level Those are two very different things. A cipher could very well be exploitable. What you are talking about is the implementation. In other words, a vulnerable cipher would be exploitable regardless of the implementation. It is not the case, though. They tried to deploy their own protocol on top of a well known cipher.