Phil Zimmermann: Beware of Snake Oil Crypto (1997)

Re:Phil Zimmermann: Beware of Snake Oil Crypto (1997) by timsally on Tuesday August 23, 2011 @03:42PM (#2918102)

You'll want to follow people in the industry as well (I've found Nate's blog in particular an enjoyable read). A lot of the practical knowledge accumulates in the brains of the guys who actually get hired to do crypto work. It's an interesting feedback loop to be sure.

Also, it's my impression that start of the art papers aren't really necessary to start off with. The implementation errors people make in their code are flaws that have long been published, sometimes for decades.

[ Parent | on HN ]

Re:Phil Zimmermann: Beware of Snake Oil Crypto (1997) by tptacek on Tuesday August 23, 2011 @03:49PM (#2918123)

Crypto papers actually kind of suck; my experience is that roughly 2/3rds of the time, the complicated formula on the page works out to a "for" loop that would be trivially easy to understand if expressed in algol syntax.

Best advice: do deep research on TLS. For every feature, do a directed search of the literature and do experimentation to try to figure out why that feature is there. Most of the features in TLS exist as a countermeasure to some attack. Follow this tack all the way down the stack, starting with the high-level protocol features and working your way all the way down through the block cipher modes and configuration that it uses.

[ Parent | on HN ]

Re:Phil Zimmermann: Beware of Snake Oil Crypto (1997) by timsally on Tuesday August 23, 2011 @03:54PM (#2918134)

Yeah there definitely is a bit of an art to reading them. But we can't have cryptographers and security professionals merging too fast... that would just make too much sense. :P

[ Parent | on HN ]