4 ms·
I guess my thinking is this. Tor is open source. If you can show a backdoor, do so. This is why open source crypto is so important these days.
by einhverfr 13y ago
I guess my thinking is this. Tor is open source. If you can show a backdoor, do so.
This is why open source crypto is so important these days.
- rhizome 13y agoOpen source ain't enough if the standard itself is vulnerable: https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html https://www.schneier.com/blog/archives/2007/11/the_strange_s...
- einhverfr 13y agoIt's not enough. However you can't have trustworthy software unless it can be audited. That's the key point. The source is there. The standards are there. We know that timing attacks may be possible. The rest is just a matter of audits. Questions are good, but they are just questions until someone looks at the code, the implementation, the design, and the rest and says "here's a problem."
- rhizome 13y agoSure, but those are questions oriented around implementation. If you go the other way: the standards are vulnerable, then the standards organizations are vulnerable, and the agencies influencing the standards organizations are a vulnerability. That is the flaw that we appear to be experiencing right now (and back in 2007 with Dual_EC_DRBG). When you speak of it only being a "matter of audits," that standard breaks down when there are none possible (or at least available) with these organizations and agencies, and that is the fundamental ingredient that produces suspicion. At the end of the day, though, the distinction I'm drawing is one between technical problems and people problems. However, recent events have taught us that the people problems in crypto are real, where before they had only really been suspected or at least minimized.
- einhverfr 13y agoRight, so open standards and open source are important. you have to be able to audit all the way through.