[148589] in cryptography@c2.net mail archive

home help back first fref pref prev next nref lref last post

Re: [Cryptography] RSA is dead.

daemon@ATHENA.MIT.EDU (Patrick Mylund Nielsen)
Sun Dec 22 18:18:35 2013

X-Original-To: cryptography@metzdowd.com
In-Reply-To: <CAOLP8p63m_C04vfonmdcG4neLxrtqZdReqEgLsL+yVEqUE0qvQ@mail.gmail.com>
Date: Sun, 22 Dec 2013 18:17:45 -0500
From: Patrick Mylund Nielsen <cryptography@patrickmylund.com>
To: Bill Cox <waywardgeek@gmail.com>
Cc: crypto@senderek.ie, "cryptography@metzdowd.com" <cryptography@metzdowd.com>,
	Peter Gutmann <pgut001@cs.auckland.ac.nz>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com

--===============7657888279216752540==
Content-Type: multipart/alternative; boundary=001a11c2b8980db1cc04ee27b8ce

--001a11c2b8980db1cc04ee27b8ce
Content-Type: text/plain; charset=UTF-8

On Sun, Dec 22, 2013 at 4:59 PM, Bill Cox <waywardgeek@gmail.com> wrote:

> Nonsense.  Most other equally capable developers should be able to
> discover a backdoor with far less effort to hide it.  Reading other
> people's code is a skill that some people never acquire, but it's generally
> easier to understand someone else's code entirely than to have created it
> from scratch.
>

http://cm.bell-labs.com/who/ken/trust.html


>
> If the code is so obscure that this is not the case, that code should not
> be used in crypto.
>

But how will we do crypto then? :)

Open source can certainly help, but it's far from a panacea. Even huge
projects like Ruby on Rails, PHP, even Linux, still have huge security
holes (code execution, privilege escalation) that have been there for years
and were *not* obscured. You're assuming that, not only will anyone look at
your code at all, they will have training in cryptography, know to be
looking for something bad, and spend a large amount of time on finding it.
All very big "if's."

I am not suggesting that closed source provides much more than obscurity
and a simpler route to profits, but the act of open sourcing your software
accomplishes nothing if nobody qualified actually reads it (apart from
giving you the PR benefit of being able to say "we're open source.")

History has shown countless times that open sourcing alone doesn't fix bad
code practices; it's not likely to more readily fix malicious ones.

--001a11c2b8980db1cc04ee27b8ce
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On S=
un, Dec 22, 2013 at 4:59 PM, Bill Cox <span dir=3D"ltr">&lt;<a href=3D"mail=
to:waywardgeek@gmail.com" target=3D"_blank">waywardgeek@gmail.com</a>&gt;</=
span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;p=
adding-left:1ex"><div dir=3D"ltr">Nonsense. =C2=A0Most other equally capabl=
e developers should be able to discover a backdoor with far less effort to =
hide it. =C2=A0Reading other people&#39;s code is a skill that some people =
never acquire, but it&#39;s generally easier to understand someone else&#39=
;s code entirely than to have created it from scratch.</div>
</blockquote><div><br></div><div><a href=3D"http://cm.bell-labs.com/who/ken=
/trust.html">http://cm.bell-labs.com/who/ken/trust.html</a><br></div><div>=
=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0=
.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-s=
tyle:solid;padding-left:1ex">
<div dir=3D"ltr"><div>
<br></div><div>If the code is so obscure that this is not the case, that co=
de should not be used in crypto. =C2=A0</div></div></blockquote><div><br></=
div><div>But how will we do crypto then? :)</div><div><br></div><div>Open s=
ource can certainly help, but it&#39;s far from a panacea. Even huge projec=
ts like Ruby on Rails, PHP, even Linux, still have huge security holes (cod=
e execution, privilege escalation) that have been there for years and were =
*not* obscured. You&#39;re assuming that, not only will anyone look at your=
 code at all, they will have training in cryptography, know to be looking f=
or something bad, and spend a large amount of time on finding it. All very =
big &quot;if&#39;s.&quot;</div>
<div><br></div><div>I am not suggesting that closed source provides much mo=
re than obscurity and a simpler route to profits, but the act of open sourc=
ing your software accomplishes nothing if nobody qualified actually reads i=
t (apart from giving you the PR benefit of being able to say &quot;we&#39;r=
e open source.&quot;)</div>
<div><br></div><div>History has shown countless times that open sourcing al=
one doesn&#39;t fix bad code practices; it&#39;s not likely to more readily=
 fix malicious ones.</div></div></div></div>

--001a11c2b8980db1cc04ee27b8ce--

--===============7657888279216752540==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
--===============7657888279216752540==--

home help back first fref pref prev next nref lref last post