Re: Simple Encrypter and Decrypter Class

From:

=?ISO-8859-1?Q?Arne_Vajh=F8j?= <arne@vajhoej.dk>

Newsgroups:

comp.lang.java.programmer

Date:

Sun, 28 Mar 2010 20:34:57 -0400

Message-ID:

<4baff5a7$0$281$14726298@news.sunsite.dk>

On 27-03-2010 13:51, Roedy Green wrote:

On Fri, 26 Mar 2010 22:51:52 +0000, rossum<rossum48@coldmail.com>
wrote, quoted or indirectly quoted someone who said :

He also
has to trust government and military experts not to withhold some
secret technique to crack a proffered encryption algorithm or
information about their advanced hardware abilities to crack codes
(e.G. some sort of quantum cracking).

This is not sensible. The NSA suggested changes to DES and SHA-0
which were later found to block certain attacks not publicly known at
the time, but obviously known to the NSA. Similarly GCHQ were aware
of public key cryptography before it became publicly known.

If Govenment security agencies know something they will keep it close
to their chests until it becomes publicly known.

I am saying you MUST trust your toolmaker if you use their tools.

Not really.

Good encryption stuff uses public known algorithms that have been
reviewed by researchers worldwide.

And implementation can (read: should) be available in source form
for review by developers worldwide.

Use of open source is probably the best approach. Even if you don't
detect the back door, or inadvertent/deliberate flaw, there is a good
chance someone else will.

If you were the US military, or the US government, would it not make
sense to offer tools that appeared secure but that allowed you to read
everyone else's messages. There is certainly motivation to do that.
They have even done that explicitly and openly in past.

Reference?

Arne