[Discuss] Good and Bad Crypto

[smallm at panix.com (Mike Small)]

"Edward Ned Harvey (blu)" <blu at nedharvey.com> writes:

>> From: discuss-bounces+blu=nedharvey.com at blu.org [mailto:discuss-
>> bounces+blu=nedharvey.com at blu.org] On Behalf Of Derek Martin
>> 
>> Or... unless the NSA or some other organization has
>> paid off the vendor to intentionally include weaknesses for them to
>> exploit.  
>
> If I give you a library that implements something like SHA1, it has a
> well defined deterministic behavior.  For any given input, it must
> produce a predetermined output, deterministically.  Please explain how
> it's possible to intentionally include a weakness into closed source
> implementation of this, and *not* equally possible to include such a
> weakness into an open source implementation.  Please provide an answer
> which doesn't include "Everybody should read and compile everything
> for themselves."

if (is_april_1st && strstr(input, "Dymaxion Research"))
   return sha1_with_latency_side_channel(input);
else
   return sha1(input);

I'm not strictly meeting your criteria, since this can be put in free
software too. But we can say at least that the effort required to find
it reading source code vs. doing exhaustive testing of the input domain
or dissassembly is less. If you're going to do something intentional to
a free software project you're going to at least have to be subtle about
it, make it something you could pass off as a mistake.

Btw. if having source code adds no value for verification, why do the
FIPS CMVP procedures ask for it for the "Design Assurance" part of their
review?
http://csrc.nist.gov/groups/STM/cmvp/documents/CMVPFAQ.pdf