Re: encryption program question

On 2012-02-29 05:15, John Smith wrote:
> that's a good point John, I hadn't thought of that. Any thoughts on the
> relative security of encrypting a file several times over with different
> keys of different lengths and different complexities?

Dunno dude. :P

I admit that when I first implemented pccipher (before I published it) I
had a facility in there that took a third parameter 'cycles' which just
repetitively encrypted its data.

I also changed the initialisation data thinking I'd make my system
slightly 'non-standard' and 'signed' so if someone wanted to try and
crack it they'd have to reverse my specific algorithm.

Then I decided I didn't really have any idea what I was doing, so the
very best thing I could do was try to implement Blowfish *exactly* the
same way everyone else had implemented it. So by the time I had a public
release I'd got rid of all my little "features".

I still lose sleep thinking I have an encryption library out there in
the wild... what if I've made a mistake and data that gets 'encrypted'
can't be 'decrypted' later? Or what if I've made a mistake and the
encryption can easily be cracked? I worry. :P

I wanted a system that was compatible between JavaScript and PHP so you
could encrypt on the client and decrypt on the server and vice versa so
I implemented a system that works in both languages. Then people got on
my case with articles like this [1], and just to prove their point I
have people like this guy [2] who link their encryption system directly
to the copy of pccipher hosted on my server... I feel like emailing the
guy and telling him I could just change the javascript file on my server
and have it send me a copy of all his 'encrypted' data. But... I don't
have the heart.

My view of encryption is that it's sort of a moot point. The only person
I reckon that I've ever stopped from accessing my files by encrypting
them is me. I have files from 10 years ago that I encrypted with God
knows what software or what key that I'll never be able to access again,
even though I'd very much like to know what was in them now. On the
other hand I doubt anyone would ever have cared to access those files.
So what was the point? I think encryption is only really useful for
temporary coding over public comms channels (all my web-sites use HTTPS
-- but of course the CIA can forge my certificates whenever they want).

Also, you can't trust your hardware or operating system because the CIA
already has it backed-doored up the wazoo and your best friend has
probably installed a key logger.

Also, the fact that two identifiable parties are communicating over a
public network over an encrypted channel is just about all you really
want to know. Who cares what they're saying. They're obviously up to
something.

Also, I really don't believe in 'algorithmic' encryption. If you want to
encrypt something properly you should be using a one time pad.

Also, if the CIA really is on your case then you have problems that
point to point encryption doesn't solve [3].

[1] http://www.matasano.com/articles/javascript-cryptography/
[2] http://www.jetcityorange.com/blowfish/
[3] https://www.progclub.org/wiki/Firewall_policy





------------------------------------

Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/win_tech_off_topic/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/win_tech_off_topic/join
    (Yahoo! ID required)

<*> To change settings via email:
    win_tech_off_topic-digest-hHKSG33TihhbjbujkaE4pw@public.gmane.org 
    win_tech_off_topic-fullfeatured-hHKSG33TihhbjbujkaE4pw@public.gmane.org

<*> To unsubscribe from this group, send an email to:
    win_tech_off_topic-unsubscribe-hHKSG33TihhbjbujkaE4pw@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/