Snake oil (cryptography)

Snake oil (cryptography)

.

Distinguishing secure cryptography from insecure cryptography can be difficult from the viewpoint of a user. Many cryptographers, such as Bruce Schneier and Phil Zimmermann, undertake to educate the public in how secure cryptography is done, as well as highlighting the misleading marketing of some cryptographic products.

The "Snake Oil FAQ" describes itself as, "a compilation of common habits of snake oil vendors. It cannot be the sole method of rating a security product, since there can be exceptions to most of these rules. [...] But if you're looking at something that exhibits several warning signs, you're probably dealing with snake oil."

Some examples of snake oil cryptography techniques

This is not an exhaustive list of snake oil signs. A more thorough list is given in the external articles linked in the section below.

; Secret system : Some encryption systems will claim to rely on a secret algorithm, technique, or device; this is categorized as security through obscurity. Criticisms of this are twofold: first, a long-standing principle, Shannon's Maxim, states that "the enemy knows the system" and that secrecy does not afford the user any advantages. Secondly, secret methods are not open to public peer review and cryptanalysis and so potential mistakes and insecurities can go unnoticed for great lengths of time.

; Technobabble : Since cryptography is a complicated subject, snake oil salespeople may use "technobabble" to sell their product.

; "Unbreakable" : Claims of a system or cryptographic method being "unbreakable" are almost always false, and are generally considered a sure sign of snake oil.

; One-time pads : One-time pads are a popular cryptographic method to invoke in advertising, because it is well known that one-time pads, when implemented correctly, are genuinely unbreakable. The problem comes in implementing one-time pads, which is rarely done correctly. Cryptographic systems that claim to be based on one-time pads are considered suspect, particularly if they do not describe how the one-time pad is implemented, or they describe a flawed implementation.

; Unsubstantiated "bit" claims : Cryptographic products are often accompanied with claims of using a high number of bits for encryption, apparently referring to the key length used. However key lengths are not directly comparable between symmetric and asymmetric systems. Furthermore, the details of implementation can render the system vulnerable. For example, in 2008 it was revealed that a number of hard drives sold with built in "128-bit AES encryption" were actually using a simple and easily defeated "XOR" scheme. AES was only used to store the key, which was easy to recover without breaking AES. [http://www.heise-online.co.uk/security/features/print/110136]

External links

* [http://www.philzimmermann.com/EN/essays/SnakeOil.html Beware of Snake Oil] — by Phil Zimmermann
* [http://www.schneier.com/crypto-gram-9902.html#snakeoil Bruce Schneier's hints for identifying crypto snake oil]
* [http://www.interhack.net/people/cmcurtin/snake-oil-faq.html The Snake Oil FAQ] by Matt Curtin and others.
* [http://www.google.com/search?q=site:www.schneier.com%20%22The%20Doghouse:%22 Google Search results for "The Doghouse" in Bruce Schneier's Crypto-Gram newsletters] — the Doghouse section of the Crypto-Gram newsletter frequently describes various snake oil encryption products, commercial or otherwise.


Wikimedia Foundation. 2010.

Игры ⚽ Нужна курсовая?

Look at other dictionaries:

  • Bruce Schneier — infobox scientist name = Bruce Schneier birth date = Birth date and age|1963|1|15|df=y residence = citizenship = field = Computer science work institutions = Counterpane Internet Security Bell Labs United States Department of Defense BT Group… …   Wikipedia

  • Silver bullet — The metaphor of the silver bullet applies to any solution perceived to have extreme effectiveness. The phrase typically appears with an expectation that some new technology or practice will easily cure a major prevailing problem.The term… …   Wikipedia

  • Self-reconfiguring modular robot — Modular self reconfiguring robotic systems or self reconfigurable modular robots are autonomous kinematic machines with variable morphology. Beyond conventional actuation, sensing and control typically found in fixed morphology robots, self… …   Wikipedia

Share the article and excerpts

Direct link
Do a right-click on the link above
and select “Copy Link”