Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Sacre bleu! (Score 4, Informative) 75

Having been to some ISO meetings recently, I can state without fear of being wrong, that ISO leaves itself wide open to corruption. There is a process, but it is nothing like a normal standards process with the usual mitigation to prevent domination by a single body and a convergent consensus process to get to an agreeable document in a reasonable time.

Participants don't even get access to the documents they are working on. They have to buy themselves copies in uneditable PDFs. The result is that people keep adding crap into specs that already exists in other specs, but no one knows to reference it. So these things become inconsistent over time.

You will find function specifications handled in one group and test & validation specifications for the same thing in a different group. So the function specification gets no consideration of testability requirements and the test & validation group don't get to specify that the thing be testable, only how it may be tested after it's been implemented to the spec that has no testability requirements in it.

ISO is not a competent organisation to write specs. Certainly not technical computer software and hardware specifications. Maybe they're OK at bridge loading specs, or non-stick coatings. I don't know.

Comment Re:So the work begins again (Score 1) 64

To find out where the NSA put the twist.

Well P-224 isn't twist secure, if that's what you're hinting at.

In reality the backdoor isn't in SP800-90A, B or C. It's in FIPS 140-2 section 4.9.2. In a FIPS certified module, that procedure applies to all RNG outputs 16 bits and above. A test that changes the data to create a stream of known algebraic inequalities. Genius.

Comment Re:Why should we trust NIST encryption? (Score 1) 64

NIST recklessly broke our trust in them by allowing known to be broken encryption into their standard. Their new document may come with all the best intentions, but it will take years to rebuild that trust. Let's wait for what the crypto community has to say about these documents, before we blindly follow their latest standards.

Well you could go with the ANSI or ISO RNG specs.

Oh wait, they're written by the same people.

Slashdot Top Deals

"Experience has proved that some people indeed know everything." -- Russell Baker

Working...