Re: [saag] A case against algorithm agility (long)

[ianG <[e-mail]>]

On 4/05/2014 04:10 am, Benjamin Kaduk wrote:
> On Sat, 3 May 2014, ianG wrote:
> 
>> 4.  Marginality.  Any benefits from tweaking/swapping/improving blackbox
>> algorithms are marginal and/or esoteric.  For the most part, any cipher
>> gets you 99.999% of the grade.  Same with any HMAC, any mode properly
>> implemented.  The only people who can or will crack weaker algorithms
>> (DES?  RC4) are people who will also bypass the crypto, and are already
>> doing it.
> 
> My apologies for cherry-picking just a single point, but commercial DES
> crackers are in the $200, 1-day range these days.


Ah very true, perhaps t-DES.  And one can buy machines for crunching
SHA256, albeit the first N digits in 10 minutes.  I guess some of the
programmable ones could be put to MD5 and SHA1 efforts.


> That there is even a
> commercial market for it suggests that they are in use, and not just by
> people who could by pass the crypto.


Yes, this is fascinating.  There's also the SSL-interceptor boxes which
allegedly will take your commercially provided sub-Root.  Who uses those
machines and why?

Information like that would be really useful to tell us what matters.



iang