4 ms·
> You can avoid it simply by not encrypting stuff at all, which is an indication of how little it has to do with security. The consequences of encrypting wrong
by hamandcheese 1y ago
> You can avoid it simply by not encrypting stuff at all, which is an indication of how little it has to do with security.
The consequences of encrypting wrongly quite possibly are worse than if you never encrypted at all.
- tptacek 1y agoGood thing FIPS 140 does virtually nothing to prevent cryptographic vulnerabilities, then.
- Spooky23 1y agoRemember when HN was losing its collective mind over Dual_EC_DRBG? That was delivered to customers with a FIPS validated software stack.
- hamandcheese 1y agoBoth of these things can be true at the same time: - "Don't use unproven cryptography" is a reasonable policy. - Policymaking can be subverted by bad actors.
- Spooky23 1y agoYes, but neither of those things have anything to do with FIPS 140-3. FIPS validation address the compliance problem of needing validation. Beyond that, the benefits are ambiguous at best.