-
"Dropping support for a broken crypto primitive is hard in practiceRead more...
- but crypto can be broken overnight
- what do we do if SHA-1 or RSA falls tomorrow?"
Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, Benne de Wegerr, "MD5 considered harmful today - Creating a rogue CA certificate", December 2008 -
"First and foremost, there is no proper excuse for continued use of a broken cryptographic primitive (MD5) when sufficiently strong alternatives are readily available, for example SHA-2. Secondly, there is no substitute for security awareness." ... "Advice from experts should be taken seriously and early in the process. In this case, MD5 should have been phased out soon after 2004."Read more...
Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, Benne de Wegerr, "MD5 considered harmful today - Creating a rogue CA certificate", December 2008 -
Read more...
“Assurance is best addressed during the initial design and engineering of security systems, NOT as an after market patch. The earlier you include a security architect in your design process, the greater the likely hood of a successful and robust design. As the quip goes, he who gets to the (module) interface first wins.”
Brian Snow, Former Technical Director of the US National Security Agency (NSA), "We need Assurance", AusCERT 2008
| fact: Security is a process |
| Synaptic Facts and FAQs - Security in general |
|
Taking the above into account, modern cryptographic security systems still rely on the security of the choice and configuration of cryptographic algorithms. Algorithms such as DES with a 56-bit key are no longer used because they fail to provide adequate security, failing in practice against attackers who can afford US$10,000 to mount the attack. If a central cryptographic component of the crypto system fails, security may be entirely lost. Synaptic has designed our security ecosystem to strengthen the security process, not just the cryptographic components. Click here to read more about Synaptic Labs' line of argument. Click here to read more about risks facing mainstream cryptographic systems today. |
| Last Updated on Friday, 16 January 2009 13:28 |
