Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I am pretty sure that the OpenPGP standard has been updated since that work, and that it is still not quite following the constructions.

Also, I do not think the NSA would have no interest at all in malleability. Suppose the NSA is trying to track messages sent through anonymous remailers (Type I, maybe because the target is using a nym server) and there is a "Max-Count: 1" header. An easy attack that exploits malleability would be the maul the message somewhere after the headers and see where a mauled messages exits the remailer network. This is probably possible with the NSA's resources and expertise, and the NSA is probably concerned about anonymity systems in general (and perhaps looking for ways to attack them).

My real point, though, is that we need to stop for a moment and re-evaluate pretty much all the cryptography standards we depend on. We really cannot say that these systems have not been deliberately sabotaged by the NSA, not with this latest revelation.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: