<div dir="ltr"><div><div><div>Mark,<br></div>When I put up my plaque as a consulting cryptanalyst, you'll be the first to know.<br><br></div>Kind regards<br><br></div>Paul Wilkins<br></div><div class="gmail_extra"><br><div class="gmail_quote">On 28 September 2016 at 15:44, Mark Smith <span dir="ltr"><<a href="mailto:markzzzsmith@gmail.com" target="_blank">markzzzsmith@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 28 September 2016 at 15:22, Paul Wilkins <<a href="mailto:paulwilkins369@gmail.com">paulwilkins369@gmail.com</a>> wrote:<br>
> Or the One Time Pad, which is perfectly secure, but ironically only so far<br>
> as it is obscure.<br>
> So should you publish your algorithm for generating a<br>
> pseudo One Time Pad? Very much depends on circumstances and use case.<br>
><br>
<br>
</span>Are you a cryptographer/cryptanalyst in the league of Bruce Schneier?<br>
Otherwise you may be falling into the trap that he has written about:<br>
<br>
"Anyone, from the most clueless amateur to the best cryptographer, can<br>
create an algorithm that he himself can't break. It's not even hard.<br>
What is hard is creating an algorithm that no one else can break, even<br>
after years of analysis."<br>
<br>
<a href="https://www.schneier.com/crypto-gram/archives/1998/1015.html#cipherdesign" rel="noreferrer" target="_blank">https://www.schneier.com/<wbr>crypto-gram/archives/1998/<wbr>1015.html#cipherdesign</a><br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
<br>
> Kind regards<br>
><br>
> Paul Wilkins<br>
><br>
> On 28 September 2016 at 14:20, Mark Smith <<a href="mailto:markzzzsmith@gmail.com">markzzzsmith@gmail.com</a>> wrote:<br>
>><br>
>> On 28 September 2016 at 13:35, Chad Kelly <<a href="mailto:chad@cpkws.com.au">chad@cpkws.com.au</a>> wrote:<br>
>> > On 9/28/2016 12:00 PM, <a href="mailto:ausnog-request@lists.ausnog.net">ausnog-request@lists.ausnog.<wbr>net</a> wrote:<br>
>> >><br>
>> >> Or should we perhaps talk about how easy it is to commit fraud?<br>
>> >><br>
>> >> Yes... lets give blueprints to people who are motived by malice so that<br>
>> >> they can go off and do what we're suggesting puts us at risk.<br>
>> ><br>
>> ><br>
>> > Security through obscurity just doesn't work.<br>
>> ><br>
>><br>
>> Actually it commonly does, this often repeated cliche is a distortion<br>
>> of Kerckhoffs's principle, which was specific to crytographic<br>
>> algorithms -<br>
>><br>
>> <a href="https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle" rel="noreferrer" target="_blank">https://en.wikipedia.org/wiki/<wbr>Kerckhoffs%27s_principle</a><br>
>><br>
>> "In cryptography, Kerckhoffs's principle (also called Kerckhoffs's<br>
>> desideratum, Kerckhoffs's assumption, axiom, or law) was stated by<br>
>> Dutch cryptographer Auguste Kerckhoffs in the 19th century: A<br>
>> cryptosystem should be secure even if everything about the system,<br>
>> except the key, is public knowledge."<br>
>><br>
>> Nature has been relying on obscurity for millennia - any animal that<br>
>> uses camouflage to hide itself is deploying obscurity, and many<br>
>> animals do. Human militaries have also successfully deployed obscurity<br>
>> via camouflage. Anybody using a firewall to block inbound ICMP pings<br>
>> is deploying obscurity.<br>
>><br>
>> When applied more generally, the real point is that obscurity is not<br>
>> sufficient to be relied upon on alone. If the secret is discovered or<br>
>> disclosed, you need some other defensive measure. For example, zebras<br>
>> can also run very fast and kick, and camouflage tanks have big guns<br>
>> and are able to escape fairly promptly over very rough terrain because<br>
>> of their tracks rather than having wheels.<br>
>><br>
>> Obscurity works well when it works, but fails absolutely when it fails.<br>
>><br>
>> > Kids are taught how to use computers and the internet at a very young<br>
>> > age<br>
>> > now a days.<br>
>> ><br>
>> > We have lawyers and signed agreements for a reason, when discussing<br>
>> > commercially sensitive data, that is why NDAs exist.<br>
>> ><br>
>><br>
>> An NDA is actually "Security through obscurity". The secondary defence<br>
>> is the consequence of being sued for breaching the NDA.<br>
>><br>
>> > As for discussing how to commit fraud and other such things, don't be<br>
>> > stupid.<br>
>> ><br>
>> > By all means discuss ways of preventing it though, plenty of discussions<br>
>> > on<br>
>> > both preventing fraud and other security methods have taken place on the<br>
>> > various web hosting forums over the years.<br>
>> ><br>
>> > These were all public discussions.<br>
>> ><br>
>> > At the end of the day it all comes down to money and the team and or<br>
>> > partners that you have involved with the business.<br>
>> ><br>
>> ><br>
>> ><br>
>> > --<br>
>> > Chad Kelly<br>
>> > Manager<br>
>> > CPK Web Services<br>
>> > web <a href="http://www.cpkws.com.au" rel="noreferrer" target="_blank">www.cpkws.com.au</a><br>
>> > phone 03 9013 4853<br>
>> ><br>
>> > ______________________________<wbr>_________________<br>
>> > AusNOG mailing list<br>
>> > <a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
>> > <a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/<wbr>mailman/listinfo/ausnog</a><br>
>> ______________________________<wbr>_________________<br>
>> AusNOG mailing list<br>
>> <a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
>> <a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/<wbr>mailman/listinfo/ausnog</a><br>
><br>
><br>
><br>
> ______________________________<wbr>_________________<br>
> AusNOG mailing list<br>
> <a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
> <a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">http://lists.ausnog.net/<wbr>mailman/listinfo/ausnog</a><br>
><br>
</div></div></blockquote></div><br></div>