SSL Was Broken by Design

Searching_ _ _ · Oct 9, 2011

William Allen Simpson wrote:

So how was it that Netscape SSL had exactly the same faults as IPsec, ISAKMP, Oakley, IKE? Political pressure! Somebody really REALLY wanted to be able track users and intercept/substitute....

Do I have proof? No, it's merely circumstantial.

So, arguing about ease of use is a waste of time, as long as the easy to use protocol was designed to be broken. It really is time to start over.

Sandy Harris wrote:

That is certainly a distinctly plausible motive. However, it would have had to be disguised as technical or ease-of-use arguments. I find it impossible to imagine any.

ianG wrote:

Proof is hard. But we might see it in the future. Not now, but in a few years.

Whoever that somebody is, they did too good a job. And now they get to pay the cost. It isn't as if they can cherry-pick the consequences, because the net was cast too wide: the whole infrastructure is institutionally weak, and if we triangulate the spots that should have been strong but are weak, they all seem to point one location.

How to reverse this? I suspect the only way is for somebody to come clean and tell people what they did.

Callas wrote:

Come on. This discussion has descended past whacko, which is where it went once the "broken by design" discussion started. Yeah, security is hard, but it's software. We know how to do that, once we understand the problems.

Marsh Ray wrote:

I don't believe we understand the problems. If we did, we wouldn't have guys in Argentina decrypting PayPal cookies transmitted over properly-encrypted TLS as a stage trick.

It's hard for me to imagine a first-rate engineer with an unbiased mind knowing all the issues today sitting down with a clean sheet of paper and coming up with CBC as a new design. Yet it continues to be regarded as some kind of gold standard. Why?
Click to expand...

SSL Was Broken by Design - Cryptome

cm1971 · Oct 13, 2011

Interesting, so if it's true the next question is why.

Hungry Man · Oct 17, 2011

Basically all network security is broken. When the internet was being created no one cared about security and most things were on closed intranets. Everything since then has basically been an attempt to slap security onto an infrastructure that wasn't designed with security in mind.

Log in or Sign up

SSL Was Broken by Design

Searching_ _ _ Registered Member

cm1971 Registered Member

Hungry Man Registered Member

Log in or Sign up

SSL Was Broken by Design

Searching_ _ _ Registered Member

cm1971 Registered Member

Hungry Man Registered Member

Useful Searches