Slashdot Mirror

← Back to Domains

Domain: nugae.com

Stories and comments across the archive that link to nugae.com.

Comments · 7

  1. The patent system helped too by Cardbox · · Score: 1 · on Symantec Restricts Crypto Export

    The patent system helped too. When we developed the world's first commercially available RSA chip the RSA patent didn't apply outside the USA (because the principle had been published in academic papers before the patent was granted) and RSA hardware couldn't be exported to compete with ours (because of USA export restrictions).

  2. Nothing has changed since 1987? by Cardbox · · Score: 1 · on Zimmermann Enters Debate on Microsoft Encryption
    This is nothing new: neither the weakness of the crypto nor the non-response by the supplier. In the late 1980s I analysed some commercially available encryption packages and found that their encryption was trivially breakable (here's the paper from Cryptologia about this).

    The worst case was a package called Fortress, marketed and endorsed by an international firm of accountants, which was so weak that it barely needed analysis at all. Their response: not a promise to strengthen the algorithm but a cloud of PR and obfuscation. Public relations people were evidently cheaper than programmers with a knowledge of crypto. It seems that they still are.

    A paper summarizing the whole story is here: The Comedy of Commercial Encryption Software.

  3. Nothing has changed since 1987? by Cardbox · · Score: 1 · on Zimmermann Enters Debate on Microsoft Encryption
    This is nothing new: neither the weakness of the crypto nor the non-response by the supplier. In the late 1980s I analysed some commercially available encryption packages and found that their encryption was trivially breakable (here's the paper from Cryptologia about this).

    The worst case was a package called Fortress, marketed and endorsed by an international firm of accountants, which was so weak that it barely needed analysis at all. Their response: not a promise to strengthen the algorithm but a cloud of PR and obfuscation. Public relations people were evidently cheaper than programmers with a knowledge of crypto. It seems that they still are.

    A paper summarizing the whole story is here: The Comedy of Commercial Encryption Software.

  4. Nothing has changed since 1987? by Cardbox · · Score: 1 · on Zimmermann Enters Debate on Microsoft Encryption
    This is nothing new: neither the weakness of the crypto nor the non-response by the supplier. In the late 1980s I analysed some commercially available encryption packages and found that their encryption was trivially breakable (here's the paper from Cryptologia about this).

    The worst case was a package called Fortress, marketed and endorsed by an international firm of accountants, which was so weak that it barely needed analysis at all. Their response: not a promise to strengthen the algorithm but a cloud of PR and obfuscation. Public relations people were evidently cheaper than programmers with a knowledge of crypto. It seems that they still are.

    A paper summarizing the whole story is here: The Comedy of Commercial Encryption Software.

  5. Paper's still safest by Cardbox · · Score: 1 · on Voting Machines Vs. Slot Machines

    Whatever safeguards you build in, the fact is that once you use machines, you have no way of knowing who won an election, you have to take someone else's word for it. Only a traditional pencil-and-paper system can be understood in principle, and verified directly, by any voter or even any voter's child. See my The Dangers of Electronic Democracy for a fuller argument.

    What I don't understand is why you need electronic/mechanical voting at all. I know the US is a poor country, but surely it can afford a few man-hours of bank tellers to count the paper votes? Or is it that the news media - who run politics as if it were a branch of entertainment - will boycott elections if the results take longer than 10 minutes to arrive?

  6. Logic versus storage by Cardbox · · Score: 1 · on Beyond Binary Computing?
    Logic is messy in bases >2, but not much chip area is usually taken by logic-- much more is taken by memory.

    Memory is a better candidate for base-N>2 than logic from the point of view of power consumption as well. If you have a picture of your mind of a typical CMOS arrangement with two transistors hanging between the power rails, one ON and one OFF, so that no current flows, it's true that a 3rd state would have to imply a flowing current. But most memory (from flash EPROM to DRAM) doesn't rely on the ON-ness or OFF-ness of transistors, it stores charge in a capacitor (DRAM) or on the other side of a tunnel barrier (EPROM). Stored charge just sits there, it doesn't flow, so no power gets wasted.

    Of course, for arithmetic, the only natural base is base 1 anyway!

  7. Insecure encryption revisited by Cardbox · · Score: 1 · on ABIT's Secure IDE Motherboard
    You can tell there's something strange when they don't mention the algorithm straight off. Eventually the spec comes clean and admits "40-bit DES"... which is fine except there's no such thing. Either they've done something DES-inspired and called it DES, or they've just set the remaining 16 bits of the DES key to a fixed value.

    40 bits = 2^40 = 10^12, which isn't many keys to check through at all. At a million keys a second it would take an average of 5.8 days to find the correct key. For slower cracking computers, scale up the time accordingly or use a small cluster.

    Promoting insecure encryption with high-sounding phrases has a long history. I remember a rash of "even the spooks can't break it" encryption packages that were so weak you could practically break by hand: that was back in the 1980s but obviously the problem hasn't gone away!

    Still, horses for courses: it's actually quite good not to use encryption that's stronger than you need, because if you do lose the key, you have some chance of paying someone to break it for you.