> A cryptosystem is incoherent if its implementation is distributed by the same entity which it purports to secure against. I don’t see why this would be true.

> A cryptosystem is incoherent if its implementation is distributed by the same entity which it purports to secure against. I don’t see why this would be true. The real problem with the cited examples is that every program downloads the latest implementation every time you want to use it. You could download the software once and then verify it is safe (by auditing the code etc) without any problem, and the security of the channel you get it over doesn’t matter. The real problem is that you can’t freeze the state of the application but the server can modify the code that’s running every time you use it.