[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
No Subject
>benefit of cryptographic authentication. However, depending on the
>mode of use of cryptography, and the underlying error detection
>mechanism, your statement about confidentiality being equivalent to
>crypto-based authentication may be false. For example, use of DES in
>OFB mode offers no protection against modification (through
"Doctor, it hurts when I do that."
"Then don't do that!"
So don't use OFB, use CFB! It's certainly the DES mode I use most
often.
My original point remains: bulk encryption is often much easier to
deploy, and gives considerably more "bang for the buck", than
end-to-end authentication. It seems pretty clear to me that had
encrypted IP tunnels been in widespread use, the Internet's recent
passive monitoring attacks would have been much less successful.
Your other comment about Kerberos with authentication being okay for
export also misses the point. Would you like to come and install
authentication-only Kerberos on *all* of my company's computers so I
can access them securely from overseas without having to violate ITAR
by carrying my encrypted IP tunnel software out of the US?
Phil
Follow-Ups: