It was the "provable security" phrase that just seemed out of place
in light of recent (but still undisclosed) events. But at least I did
differentiate between the flaws in the implementation and flaws in
the underlying crypto... or at least I tried.
The thing to remember is that "proven secure" doesn't mean that any real existing protocol specifications or implementations are actually secure! It means that some cryptographers used some (huge) set of simplifications and assumptions to define a model in which some aspect of the protocol has been proven to resist specific known attacks. Crypto papers assume their audience knows exactly what these assumptions are by reference to one of the standard proof models.
I think Matthew is doing something really good here by trying to bridge the gap between the proofs and the messy reality.
Good example: one-time pads are proven secure, but if I write an application that swaps OTPs before beginning encrypted communication with those pads, bad things will happen.
Comments
It was the "provable security" phrase that just seemed out of place in light of recent (but still undisclosed) events. But at least I did differentiate between the flaws in the implementation and flaws in the underlying crypto... or at least I tried.
The thing to remember is that "proven secure" doesn't mean that any real existing protocol specifications or implementations are actually secure! It means that some cryptographers used some (huge) set of simplifications and assumptions to define a model in which some aspect of the protocol has been proven to resist specific known attacks. Crypto papers assume their audience knows exactly what these assumptions are by reference to one of the standard proof models.
I think Matthew is doing something really good here by trying to bridge the gap between the proofs and the messy reality.
Good example: one-time pads are proven secure, but if I write an application that swaps OTPs before beginning encrypted communication with those pads, bad things will happen.