71–80 of 93 posts
Isn't key derivation function completely separate from aes implementation. I mean you could have used the same broken key derivation with some other aes implementation. Also aes-1024 sounds like some proprietary thingy, not something people should probably trust anyway...
Any time I see encryption described as "military grade" it usually sets of my bullshit detector.
Earlier quoted context omitted.
The company who wrote the software are in the presentation and explain this - 192 / 256 could not be used because of export restrictions, so AES-128 is actually what they used. 1024 is marketing fluff, which they justified by running 8 passes on the file encryption key (to paraphrase the presentation - ‘Regular consumers don’t understand encryption standards, but think bigger numbers = better and trust the term Milit…
No military buys "military-grade" anything. Militaries buy stuff that conforms to some specific military standard.
I'm reminded of the comments of chemistry experts about the UK government using the phrase "military-grade nerve agent"[0]. Firstly, no military would ever admit to owning the stuff (since even the permanent members of the UN security council are signatories of the Chemical Weapons Convention), but, more obviously, there's no such thing as a civilian-grade nerve agent.
I suppose what they meant was "no medical, industrial, or commercial uses", or "requires the resources of an entire country to create and manage", but those aren't attributes that you would want for your security software.
[0] The Financial Times, 2018 - https://archive.ph/0eZl8
Earlier quoted context omitted.
No military buys "military-grade" anything. Militaries buy stuff that conforms to some specific military standard.
Right, it's an unhelpful qualifier. I'm reminded of the comments of chemistry experts about the UK government using the phrase "military-grade nerve agent"[0]. Firstly, no military would ever admit to owning the stuff (since even the permanent members of the UN security council are signatories of the Chemical Weapons Convention), but, more obviously, there's no such thing as a civilian-grade nerve agent. I suppose wh…
Depends who you are - If you are in marketing, it's a really helpful qualifier (i.e. it's something that the general public clearly put stock in, as mentioned in the presentation).
Earlier quoted context omitted.
Off topic, but please consider using the correct tense when talking about people. E.g ”Uses” instead of ”used”, otherwise you are implying that the person in question is dead… (After reading your comment I went to wikipedia to check that Bruce Schneier hadn’t unexpectedly passed away.)
I used past tense because he stopped his blog/mailing list ;) At least in the form I used to read it. But I agree that 'used to use' would be a better form without this connotation. I will strive to use this in the future in such cases. He used to have a monthly mailing list, and I wasn't sure whether he still had a blog or something.
Earlier quoted context omitted.
"Military grade encryption" means that the government has signed off on the algorithms use for information up to a specific classification level. Probably the NSA, but maybe the DOD has their own department. It's certainly a vote of confidence, probably by people more educated about cryptography than you specifically, although possibly less trusted by you (in terms of skill and/or ulterior motives) than other people.…
Unless someone is specifically naming the military standard they are compliant with (and provides an auditing record!) it’s bullshit, 99.99% of the time. Legit vendors who sell actual mil-spec equipment (except stuff that has known shitty mil-specs like entrenching tools) don’t use ‘military grade’ anywhere when they’re selling to the military. They go through procurement and identify the specific mil-spec’s they are…
What really happened: Yet another random company simply implemented the password code wrong. This has nothing to do with the integrity of AES which remains unbroken in principle.
Nothing to see here.
Earlier quoted context omitted.
To see how insecure a mode of operation can be, Wikipedia has a picture that was encrypted with ECB: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...
That picture has become some sort of meme of itself (I've heard it referred as "you can see penguins through ECB") because it's so damn popular. However ECB is a lot worse than "you can see data patterns"--with a chosen plaintext attack (very common scenario in networking and storage applications) any dumbass can decrypt it trivially.
Earlier quoted context omitted.
No military buys "military-grade" anything. Militaries buy stuff that conforms to some specific military standard.
Right, it's an unhelpful qualifier. I'm reminded of the comments of chemistry experts about the UK government using the phrase "military-grade nerve agent"[0]. Firstly, no military would ever admit to owning the stuff (since even the permanent members of the UN security council are signatories of the Chemical Weapons Convention), but, more obviously, there's no such thing as a civilian-grade nerve agent. I suppose wh…
Paraoxon? Dichlorodiphenyltrichloroethane? Bifenthrin?
Earlier quoted context omitted.
The bullshit "AES-1024" is quoted from the product description and repeated in the title as clickbait.
The title is funny, they even intentionally put "military grade" in there to make the sarcasm even more apparent. This is different from click bait, which I see as an intentional dark pattern.
Earlier quoted context omitted.
The title is funny, they even intentionally put "military grade" in there to make the sarcasm even more apparent. This is different from click bait, which I see as an intentional dark pattern.
I think it would be a far better headline if "military grade AES-1024" were put in scare quotes. Otherwise it just looks like clickbait and presumably keeps a lot of people from ever clicking on it.