* Donald Eastlake: > It's always possible to make protocols more secure at higher cost.
On the other hand, group key vulnerabilities are nothing new. It's just that many protocol designers seem to not understand them. Back when Cisco proposed XAUTH for IPsec, there was a heated discussion about password strength and other irrelevancies, but as far as I could later reconstruct the discussion, no one objected to the group key concept as such. It was only much later, when people used XAUTH in large deployments for providing general Internet access over insecure media, that the group key was recognized as a vulnerability. It's amazing that people still fail for this group key thing. There is quite a simple rule: If you choose the secret bits without constraints (except length and formatting), and proceed to share those bits, there can be no protection from those with whom you share, no matter what cryptographic algorithms you use. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majord...@metzdowd.com