PGP creator cooks up Net phone protection

TalkBack 4 of 4:

« Previous

• Thread View
• Flat View

Skype crypto is undocumented, therefore untrustable

Skype's transparency is nice. But Skype takes a very strong "our software is proprietary and we won't document it because that would let you compete with us on our own platform and we'd lose money" approach. That means it's not possible to evaluate the crypto approaches they've taken, much less seriously review it for bugs or design flaws, so it's not possible for any serious crypto expert to trust it. Sure, there are some good algorithms like AES in there - but most crypto system flaws are in the key handling, data file handling, negotiation protocols, or other things beyond the raw algorithms. Skype may try to Not Be Evil, so maybe they're not deliberately shipping their keys to the CIA, KGB, or Belgian EU Police, but that doesn't mean some 15-year-old kid won't disassemble their product and find holes in it like the holes in DVD encryption, or some grad students who broke GSM crypto over lunchtime or MS PPTP or even early versions of PGP. If you don't care what's under the hood, fine, but if you *do* care, finding that the hood is welded shut isn't the right answer.

Posted by: billstewart_z   Posted on: 08/05/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Open Standards Technologies Provide the Ingredients for Delivering Security Across the Papa Gino's Enterprise Dell Papa Gino's Holdings Corporation founded by the entrepreneur operates one ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Building the Virtualized Enterprise with VMware Infrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now