Slashdot Mirror

← Back to Stories (view on slashdot.org)

The Crypto Gardening Guide and Planting Tips

Posted by michael on from the nous-devons-cultiver-nos-jardins dept.

ncostigan writes "Peter Gutmann of cryptlib fame has written a very readable paper on real-world constraints for cryptographers, and points out problems that their designs will run into when attempts are made to deploy them. Also included is a motivational list of extremely uncool problems that implementors have been building ad-hoc solutions for since no formal ones exist."

5 of 91 comments (clear)

  1. Also available on... by vpreHoose · · Score: 2, Informative

    Cryptome

  2. Re:Why do I find that so funny? by Llanfairpwllgwyngyll · · Score: 4, Informative

    If you're reading about crypto, and you have not heard of Peter Gutmann, then you are either just *starting* to read about crypto, or you have missed out some of the most important *practical* parts of your reading!

    Check also the X509 Style Guide. Outstanding and insightful. Trust no one claiming to know about PKI unless they have read and understood this :-)

  3. Re:Very readable.. by xmath · · Score: 5, Informative

    Message Authentication Code
    Hashed Message Authentication Code
    Pseudo Random Function
    Initialization Vector

  4. for beginners i totally recommend this: by colonel.sys · · Score: 3, Informative

    bruce schneier: secrets and lies - digital security in a networked world

    (http://www.amazon.com/exec/obidos/tg/detail/-/0 47 1253111/qid=1044455851/sr=8-2/ref=sr_8_2/102-63475 44-3715317?v=glance&s=books&n=507846)

    excellent book on crypto and security basics. also contains basic concepts of avoiding general security issues.

    nico

    --
    We are all individualists!
  5. Re:One of the problems with crypto by Steve+Hamlin · · Score: 2, Informative

    Is that the data is only as secure as the OS it is on - at some point, the OS' protections become the only thing protecting the data from being decrypted.

    Data encrypted with secure methods does NOT depend on the underlying OS. Why encrypt anything, if you can just crack the OS?

    Oh, wait, I forgot that encrypted data gets sent plain through emails, and is posted publically, and is used on public, non-secure systems. Doesn't dnet post the encrypted message, and offer rewards for cracking?

    It doesn't matter is you crack the OS because properly secured data is not dependent on anything else.


    This means that running it on anything but Linux is a bad idea, b/c you cannot read the source...

    You realize Linux is just a kernel, right?

    And not the only one?

    (I realize I've probably been trolled, but...)