WDef
Group: Members
Posts: 798
Joined: Sep. 2005 |
 |
Posted: June 21 2007,14:58 |
 |
| Quote | | You're correct ... you're also correct .. |
I know I'm correct :=) (Just kidding! I occasionally do put my foot in it ... not this time)
Seriously, getting into a discussion abut the quality of an encryption app is very difficult for non-experts, which is probably most of us here (certainly me).
Even the experts and so-called "experts" get it wrong sometimes, and there's quite a lot of politics involved. It can be quite hard to get definitive opinions. About the only thing everyone seems to agree on is that gnupg/pgp is the standard.
That, and that users focus too much on ciphers and key lengths and not enough on the implementation and system and what happens to keys and plaintext, including, as lucky13 says, using a decent password.
I was horrifed once to read an article in Linux Journal a few years ago by a so-called expert who laid out a scheme for encrypting the root filesystem on one's laptop using dmcrypt and a single-line unencrypted key on the usbstick. If the usbstick gets into the attacker's hands, then that scheme is useless. A really bad, uninformed article.
About the best a non-expert can do is to google and look for criticisms of the particular prog or ways to use it better.
An instructive example is to follow the historical email list war between the dmcrypt/cryptsetupLUKS folk and loop-aes. Mucho nastiness all round, but to my mind loop-aes came out as the clear winner because Jari Ruusu, the loop-aes developer, fired off a range of serious criticisms of the implementation of dmcrypt (and cryptoloop and truecrypt) that all turned out to be correct. But for a while, the dmcrypt developers, who were way behind loop-aes in terms of their development status (I think still are) and I think rather defensive, denied it all with FUD, said loop-aes was actually spreading FUD, and that the weakness described was not significant. But in encryption, there's really no such things as an insignificant weakness per se, that's only something that makes sense in the context of a threat model. Anyway they eventually moved to address some of Jari's criticisms. Truecrypt acted much faster - in fact they responded to a similar criticism very fast indeed. This is a bit of simplification of the whole story,otherwise I'd be typing here forever.
But you'll find people who'll say all this is back to front :=)
|
.
DSL Market ,
Great VPS hosting provided by Tektonic
