Re: [TLS] Comparative cipher suite strengths

[Dean Anderson <[e-mail]>]

On Tue, 5 May 2009, Peter Gutmann wrote:

> "Blumenthal, Uri" <[e-mail]> writes:
> 
> >While this certainly makes a nice tea-table story, I question the "historical
> >truthfulness" of it.
> 
> As I said, it was told to me by someone involved at the time, but it was some
> years ago and unfortunately I didn't think to take names and numbers.

Well, if Peter's recollection is not historically correct, and many such
stories get things wrong (me included---I once thought I knew the story
(from a third-hand source) about an event between RMS and ATT that
occurred before GNU was formed. I thought to check the facts with RMS,
and RMS told me I had it wrong--I heard it verbally, and didn't remember
the precise source, so I don't know if I misremembered it or my source
had it wrong.  The point is: We all fail sometimes. If Peter has the
history wrong, please state the correct history with your sources of
fact. Just saying Peter has it wrong is no help.


> You're assuming that the people in these organisations work like 
> Turing machines
[...]
> because the target within the company didn't understand why they should
> use prescribed algorithms when the snake oil was obviously better 
[...]
> try enough people in enough organisations and eventually they'll fall
> for it, no matter how the Turing-machine model says they should react.


Yep, that about covers it.  I think we all probably have to deal with
snake-oilers at some time or other. And my experience is about the same:
its tedious. It seems to be a colossal waste of time. Fortunately or
unfortunately, the snake-oiler's I'm currently fighting keep sending me
a reminder once or twice a month to do a little more work... ;-)

But snake-oil has to be discredited on its de-merits, not by altering
specifications to encompass both snake-oil and non-snake-oil.  The best
thing you can do is put up a web page discrediting the snake-oilers to
help others do the same. And promote the non-snake-oil on its 
comparative merits until people catch on.

		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000