this post was submitted on 22 Oct 2023
442 points (98.9% liked)
Privacy
31181 readers
474 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Good luck with that. FOSS is transparency on a source code level, there's no obscurity they can hide their back door behind.
https://slashdot.org/story/420213
You realize nobody would know about this in the first place if it was Proprietary, right?
FOSS allows for whistleblowers, scrutiny, and audits. Proprietary 'security via obscurity' does not.
I'm perfectly aware of all that. but cryptography is an extremely complicated discipline that even the most experienced mathematicians have a hard time to design and scrutinize an algorithm, they heavily rely on peer review. If one major institution like the NIST is biased by the NSA, they will have a bigger chance of compromising algorithms if that are their intentions.
You'd be surprised what the world wide collective of Cryptographers are capable of when they're able to scrutinize a project in the first place. Which would you prefer? A closed unscrutinizable encryption algorithm or one that's entirely open from the ground up?
NIST could do damage if they're biased, but it's not like people aren't keeping a close eye on them and scrutinizing as many mistakes as possible. Especially for an algorithm as globally important as PQC.
I'm totally against anything proprietary. That's the first requisite for anything I use. And I'm not advocating for proprietary algorithms at all, that would be very much the demise of encryption.
I'm just worried that a sufficiently influent actor (let's say a government) could theoretically bribe these institutions to promote weaker encryption standards. I'm not even saying they are trying to introduce backdoors, just that like the article suggest they might bias organizations to support weaker algorithms.
AES 128 bits is still considered secure in public institutions, when modern computers can do much stronger encryption without being noticeable slower.
A huge amount of organization are already biased and using weaker algorithms... They just do so under the obscurity of proprietary software so it's much harder to scrutinize them.