Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You provided it as a proof-point of some sort, but I've led lab exercises of freshmen CS students doing the same exercise, so I'm unclear what it's proof of.


Proof that you don't need to be super-human to build something useful, also demonstrated by your freshman CS student anecdote.


Anybody can build a Diffie-Hellman protocol. You can practically do with a calculator; in fact, we did that as an exercise at a talk, with a big audience, using frisbees to "exchange" the keys. But: the talk was about how, as a pentester, to trivially break these systems, because making a system that uses a DH key exchange safely, as opposed to one that simply appears correct in unit tests, is treacherously hard.

I'm still curious about what you could have possibly meant by learning about "weaknesses" like "known-plaintext attacks". Can you say more?


It's been years, but I recall that, for example, when you know every piece of plaintext starts with "https://www", or perhaps know the full contents of particular messages, it may become some degree easier to brute force your way to a key. I don't think it's a concern for standards in broad use, more like something you would worry about if you were cooking up your own cipher.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: