Re: [Tcpcrypt] Initial questions

[ianG <[e-mail]>]

On 18/06/2014 22:20 pm, Tony Arcieri wrote:
> On Wed, Jun 18, 2014 at 2:15 PM, Sandy Harris <[e-mail]
> <mailto:[e-mail]>> wrote:
> 
>     Why on Earth do these have "When encryption is enabled"?
> 
> 
>  "Every once in a while, someone not an NSA employee, but who had
>   longstanding ties to NSA, would make a suggestion that reduced privacy
>   or security, but which seemed to make sense when viewed by people who
>   didn't know much about crypto. For example, using the same IV
>   (initialization vector) throughout a session, rather than making a new
>   one for each packet. Or, retaining a way to for this encryption
>   protocol to specify that no encryption is to be applied."
> 
>     -- John Gilmore 



The problem with this view is that we can also do the same things to
ourselves, without the need of hints from the NSA.  If you take a big
room of experts, they've all got their hobby horses, their pet wishes.
The sum total of those pet features would result in a non-working
protocol, and half of those pet features would result in a mess --
perhaps working, sometimes secure.

Having said that, in this fertile ground, it is certainly easy for
groups like the NSA to influence and tilt certain directions.  But we
shouldn't be so quick to blame them.  It is the job of spooks to
interfere, and it is we that are at fault first and foremost by
providing a target-rich environment.



iang