3 ms·
That project wasn't for school.
by smolder 2y ago
That project wasn't for school.
- tptacek 2y agoYou provided it as a proof-point of some sort, but I've led lab exercises of freshmen CS students doing the same exercise, so I'm unclear what it's proof of.
- smolder 2y agoProof that you don't need to be super-human to build something useful, also demonstrated by your freshman CS student anecdote.
- tptacek 2y agoAnybody can build a Diffie-Hellman protocol. You can practically do with a calculator; in fact, we did that as an exercise at a talk, with a big audience, using frisbees to "exchange" the keys. But: the talk was about how, as a pentester, to trivially break these systems, because making a system that uses a DH key exchange safely, as opposed to one that simply appears correct in unit tests, is treacherously hard. I'm still curious about what you could have possibly meant by learning about "weaknesses" like "known-plaintext attacks". Can you say more?
- smolder 2y agoIt's been years, but I recall that, for example, when you know every piece of plaintext starts with "https://www https://www", or perhaps know the full contents of particular messages, it may become some degree easier to brute force your way to a key. I don't think it's a concern for standards in broad use, more like something you would worry about if you were cooking up your own cipher.