[CFRG] Re: RG Last Call on draft-irtf-cfrg-hybrid-kems-12 and draft-irtf-cfrg-concrete-hybrid-kems-04

[Peter Gutmann <[e-mail]>]

Salz, Rich <rsalz=[e-mail]> writes:

>It means that a cryptographer cannot prevent things like buffer overflows or
>use-after-free and the like.

Succinctly summed up in Shamir's Law:

  Cryptography is bypassed, not attacked.

(for the pedants, what he actually said was "Cryptography is usually bypassed.
I am not aware of any major world-class security system employing cryptography
in which the hackers penetrated the system by actually going through the
cryptanalysis [...] usually there are much simpler ways of penetrating the
security system")

You've also got the inverse of Shamir's Law, from Drew Gross:

  I love crypto, it tells me what part of the system not to bother attacking.

Or my own rather less succinct:

  The crypto code actually serves as a marvellous roadmap to all of the logic
  and authentication errors that surround it.  Searching for the names of
  crypto functions in someone’s code therefore makes it easier to identify
  where you need to look for logic flaws and other bugs.  Focusing on the
  crypto in this manner as a shortcut to where the security vulnerabilities
  are makes the process of finding security holes extremely efficient

If you want a more succinct version of that whole paragraph, I could offer:

  Cherchez la GCM

That footgun encryption mode is just a gift that keeps on giving.

Peter.