The state of crypto products
Sep. 29th, 2003 03:57 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
ciphergothJust read this story on Slashdot, so in curiosity I downloaded the paper. And I have to echo and extend comments Peter Gutmann made about the state of crypto under Linux: when you hear about a product that uses crypto, open source, Linux based or otherwise, just assume that the crypto is woefully cack-handed rubbish from someone who's read Applied Cryptography if that.
ssh v2 is mostly OK. TLS (SSL v3.1) is mostly OK. GPG is mostly OK. IPSec is mostly OK. I don't know of anything else that people in the field think well of.
ssh v2 is mostly OK. TLS (SSL v3.1) is mostly OK. GPG is mostly OK. IPSec is mostly OK. I don't know of anything else that people in the field think well of.
![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
no subject
Date: 2003-09-29 05:08 pm (UTC)OSS - It's nobody's job to fix anything or provide a solid total package.
CSS - Management decides to fix only those issues that everyone knows about.
Honestly, I think important crypto for an ordinary geek is impractical and for a lay user it would be reckless. It might work and be better than nothing, but betting your freedom on it would be reckless.
Pavlos