Re: [TLS] Comparative cipher suite strengths

[Dean Anderson <[e-mail]>]

I think this Schnier "Cryptogram" is particularly insightful on the 
subject of Snake oil, and even mentions the issue of AES key lengths.  I 
found it by googling for "JAWS L5 Meganet".  :-)

http://www.ussrback.com/crypto/misc/cryptogram-021599.txt

		--Dean

On Tue, 5 May 2009, Dean Anderson wrote:

> On Tue, 5 May 2009, Peter Gutmann wrote:
> 
> > "Blumenthal, Uri" <[e-mail]> writes:
> > 
> > >While this certainly makes a nice tea-table story, I question the "historical
> > >truthfulness" of it.
> > 
> > As I said, it was told to me by someone involved at the time, but it was some
> > years ago and unfortunately I didn't think to take names and numbers.
> 
> Well, if Peter's recollection is not historically correct, and many such
> stories get things wrong (me included---I once thought I knew the story
> (from a third-hand source) about an event between RMS and ATT that
> occurred before GNU was formed. I thought to check the facts with RMS,
> and RMS told me I had it wrong--I heard it verbally, and didn't remember
> the precise source, so I don't know if I misremembered it or my source
> had it wrong.  The point is: We all fail sometimes. If Peter has the
> history wrong, please state the correct history with your sources of
> fact. Just saying Peter has it wrong is no help.
> 
> 
> > You're assuming that the people in these organisations work like 
> > Turing machines
> [...]
> > because the target within the company didn't understand why they should
> > use prescribed algorithms when the snake oil was obviously better 
> [...]
> > try enough people in enough organisations and eventually they'll fall
> > for it, no matter how the Turing-machine model says they should react.
> 
> 
> Yep, that about covers it.  I think we all probably have to deal with
> snake-oilers at some time or other. And my experience is about the same:
> its tedious. It seems to be a colossal waste of time. Fortunately or
> unfortunately, the snake-oiler's I'm currently fighting keep sending me
> a reminder once or twice a month to do a little more work... ;-)
> 
> But snake-oil has to be discredited on its de-merits, not by altering
> specifications to encompass both snake-oil and non-snake-oil.  The best
> thing you can do is put up a web page discrediting the snake-oilers to
> help others do the same. And promote the non-snake-oil on its 
> comparative merits until people catch on.
> 
> 		--Dean
> 
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000