4 ms·
It's not enough. However you can't have trustworthy software unless it can be audited. That's the key point. The source is there. The standards are there.
by einhverfr 13y ago
It's not enough. However you can't have trustworthy software unless it can be audited. That's the key point.
The source is there. The standards are there. We know that timing attacks may be possible. The rest is just a matter of audits. Questions are good, but they are just questions until someone looks at the code, the implementation, the design, and the rest and says "here's a problem."
- rhizome 13y agoSure, but those are questions oriented around implementation. If you go the other way: the standards are vulnerable, then the standards organizations are vulnerable, and the agencies influencing the standards organizations are a vulnerability. That is the flaw that we appear to be experiencing right now (and back in 2007 with Dual_EC_DRBG). When you speak of it only being a "matter of audits," that standard breaks down when there are none possible (or at least available) with these organizations and agencies, and that is the fundamental ingredient that produces suspicion. At the end of the day, though, the distinction I'm drawing is one between technical problems and people problems. However, recent events have taught us that the people problems in crypto are real, where before they had only really been suspected or at least minimized.
- einhverfr 13y agoRight, so open standards and open source are important. you have to be able to audit all the way through.