Reply to post: "...outdated encryption..."

90% of SSL VPNs are ‘hopelessly insecure’, say researchers

JeffyPoooh
Pint

"...outdated encryption..."

"...outdated encryption..."

The word "outdated" papers-over a recurring theme in the history of cryptography.

It often refers to an encryption standard that was once believed to be secure, but was then subsequently shown to be less secure than was once imagined.

Preempting your next thought: Almost all of the time, at least in the history of modern cryptography, the 'outdatedness' has NOTHING to do with the progress of Moore's Law and 'brute forcing'. More often it has to do with the cryptanalysts beavering away until they uncover the seemingly-inevitable subtle flaws; either in the fundamental algorithm, some particular implementation, or (in some applications) an unacceptably high risk of operator error.

Too many have the incorrect impression that the deterioration over time of an encryption standard is due only to some external process, like the weathering or erosion of a big rock. In fact, 'the rock' was typically internally-flawed from Day 0. The subtle flaws are eventually exposed by close examination, which may take several years.

The timing of the public pronouncement of 'outdatedness' often comes down to motivation (effort, speed) of the crackers, or even if they wish to keep their success a secret for a while (e.g. Churchill and the Enigma, kept Ultra Secret for decades). An encryption standard may actually be 'outdated', but hardly anyone is in on the secret.

The adjective 'outdated' tends to support muddled naïve, wishful thinking about whatever cryptography algorithm is the present standard du jour.

Sometimes the best adjective would be 'flawed'.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon