Re: My my, how time flies ...... it's been about "1 hour" -- anyone cracked CryptoSMS yet?

Crypto_at_S.M.S
Date: 08/26/05 

Date: Fri, 26 Aug 2005 10:59:40 +1000

Joe Peschel wrote:

> " \"- Prof. Jonez©\"" <jonez@norcom.ca> wrote in
> news:fLlPe.20$nh6.4497@news.uswest.net:
>
>
>>What makes you think any attacker would have the source code
>>of any given encryption program to work with?
>>
>
>
> One always has to assume that the attacker knows everything about the
> encryption system, except the key. See Kerckhoffs' principle: "the security
> of a cryptosystem must depend only on the key," and Shannon's maxim: "the
> enemy knows the system."
>
> Schneier explained, in his May 2002 Cryptogram, why the principle is
> important.
>
> The reasoning behind Kerckhoffs' Principle is compelling.
> If the cryptographic algorithm must remain secret in
> order for the system to be secure, then the system is be
> less secure. The system is less secure, because security
> is affected if the algorithm falls into enemy hands.
> It's harder to set up different communications nets,
> because it would be necessary to change algorithms as
> well as keys. The resultant system is more fragile,
> simply because there are more secrets that need to be
> kept. In a well-designed system, only the key needs to
> be secret; in fact, everything else should be assumed to
> be public.
>
> J
>

Schneier's statement does not mention source code. It talks about
algorithms, and you already know the algorithms used by CryptoSMS.
That has been stated over&over. You know everything about these
algorithms (and the order in which they are applied), so the conditions
of Kerckhoffs' Principle have been met.

What in the above statements compels cryptosystem implementors to
provide attackers with the source code?

Relevant Pages

  • Simple Unbreakable (Sipher Idea)
    ... to eliminate attackers possibilities for breaking the cipher using ... which the attacker is not assumed ... The algorithms also demonstrate a method, ... produced one-time-pad. ...
    (sci.crypt)
  • Re: P-value from chi-square value: source code
    ... the accuracy being lost by using good algorithms. ... I do not think an algorithm for a chi-squared distribution ... TOMS708 and its code for the cdf of the gamma ... Anyone looking for source code for the gamma distribution should watch ...
    (sci.stat.math)
  • [UNIX] Mono XSP ASP.NET Server Source Code Disclosure Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Mono XSP ASP.NET Server Source Code Disclosure Vulnerability ... Using a source code disclosure attack, an attacker can retrieve the source ...
    (Securiteam)
  • Re: Matlab is a closed environment
    ... reproduce a black box no matter how satisfied YOU are with it. ... you'd have a hard time reproducing results using any source code written ... The quality of pulished literature on algorithms ... program behaviour a complying C++ compiler will produce in response ...
    (comp.soft-sys.matlab)
  • Re: Web App Script Capture
    ... an attacker can fingerprint the ... However, since it is an open source app, I took a "short cut" by looking at the ... work-around for that problem (stealing source code). ...
    (Pen-Test)