Peter Gutmann wrote:
Looks like Motorola made a similar mistake to Sony in their digital
signatures:
http://nenolod.net/~nenolod/sholes-keyleak-explained.html
The description is a bit confusing (did they really use Elgamal signatures
rather than, say, DSA?), but it's basically the same thing Sony did. If they
used actual Elgamal sigs though they went even further than Sony, along with
rolling their own broken crypto implementation they also decided to go their
own way with the signature scheme they used. As I've said a number of times
before:
In practice you don.t need to know all the gory details of encryption modes
and IVs and other cryptoplumbing, you just need to make sure that you apply
the right tool for the job. The right tool for fixing a blocked drain is a
plumber, and the right tool for dealing with problems requiring cryptography
is a security library written by someone who knows what they.re doing.
It seems that one "gory detail" or "other cryptoplumbing" that one HAS
TO WORRY ABOUT is secret random number generation, especially when
discrete-log crypto is relied upon. The reported blunder occurred in
this area.
I don't see how a security library author can ascertain that the
end-user production environment will indeed provide a good secret random
number source.
Or to quote Bruce:
"anyone who creates his or her own cryptographic primitives is either a
genius or a fool. Given the genius/fool ratio for out species, the odds
aren't very good".
Peter.
--
- Thierry Moreau
CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, QC, Canada H2M 2A1
http://www.connotech.com
_______________________________________________
cryptography mailing list
[email protected]
http://lists.randombit.net/mailman/listinfo/cryptography
