131–140 of 176 posts
Surprising they didn't prove that they actually control $200k worth of BTC when it's so gosh darned simple to do so. How do I know they are being honest? They should have signed that blog post with their BTC wallet.
http://www.complex.com/tech/2012/08/the-25-richest-tech-entr...
I don't think money is going to be a problem here.
This is a bullshit challenge. The attack model in which it is set is nothing like the theoretical models cryptographic systems are designed to be secure against, and even less like how crypto software is actually attacked in practice. There is no possibility for known plaintext, chosen plaintext, chosen ciphertext, side channels, etc. If they just encrypted their communications with AES-128 in ECB mode with a fixed r…
Earlier quoted context omitted.
Our Twofish cryptanalysis contest offers a $10K prize for the best negative comments on Twofish that aren't written by the authors. There are no arbitrary definitions of what a winning analysis is. There is no ciphertext to break or keys to recover. We are simply rewarding the most successful cryptanalysis research result, whatever it may be and however successful it is (or is not). Again, the contest is fair because…
Moxie is a great researcher and WhisperSystems seem serious. However, I don't understand why you claim that TextSecure is designed by cryptographers. From what I've seen, they use something called the "Axolotl Ratchet", developed by Trevor Perrin. A quick search of his name didn't yield any crypto papers / research by him. Also, you write " and has been studied in detail for years " There are no links/references to c…
The point is, the above challenge is impossible without a MITM attack, and that MITM attack has to take place when I first save the server keys on my computer. The point is that there are numerous cryptographic protocols available which can not be broken using currently available technology.
This contest will prove one thing, and one thing only, the cryptographic algorithm they are using is secure. And it SHOULD be, considering that there are a lot of publicly available secure algorithms. This contest, however, will not prove that the Telegram service is secure.
Cryptography Snake Oil Warning Sign #9: Cracking contests. https://www.schneier.com/crypto-gram-9902.html (1999)
It seems to me that offering a bug bounty can significantly improve the security of a system, even when the prize-money is relatively small.
[1] http://www.tarsnap.com/bugbounty.html
[2] http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-...
Just so we're clear, this rules out:
* Chosen plaintext attacks
* Chosen ciphertext attacks
* Adaptive chosen ciphertext attacks
* EDIT: Also any kind of side channel
The only thing that would fail to meet this definition of security is repeating key XOR. And RC4.
I have a better challenge! From today until March 1, 2014, I will SSH into my server and type a secret email address on the command prompt. Send me an email to that address and tell me my crypto key, and I will allow you to pet my dog for 5 minutes. (Sorry, I do not have $200k in BTC, or any other currency, for that matter :(, but my dog is totally cute.) The point is, the above challenge is impossible without a MITM…
I have a better challenge! From today until March 1, 2014, I will SSH into my server and type a secret email address on the command prompt. Send me an email to that address and tell me my crypto key, and I will allow you to pet my dog for 5 minutes. (Sorry, I do not have $200k in BTC, or any other currency, for that matter :(, but my dog is totally cute.) The point is, the above challenge is impossible without a MITM…
Your challenge isn't at all hard. An attacker could get into your server using some other method besides breaking SSH then simply look at your bash history.
Cryptography Snake Oil Warning Sign #9: Cracking contests. https://www.schneier.com/crypto-gram-9902.html (1999)
Tarsnap has a bug-bounty program [1] which has uncovered numerous bugs, including a critical security bug [2] It seems to me that offering a bug bounty can significantly improve the security of a system, even when the prize-money is relatively small. [1] http://www.tarsnap.com/bugbounty.html [2] http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-...
Telegram, on the other hand, is trying to prove that their algorithm is unbreakable. AES is pretty good too. As is noted in other comments, it's generally the system, not the algorithm, that gets broken.