Tutanota is the secure email service, built in Germany. Use encrypted emails on all devices with our open source email client, mobile apps & desktop clients.
You realize nobody would know about this in the first place if it was Proprietary, right?
FOSS allows for whistleblowers, scrutiny, and audits. Proprietary 'security via obscurity' does not.
I'm perfectly aware of all that. but cryptography is an extremely complicated discipline that even the most experienced mathematicians have a hard time to design and scrutinize an algorithm, they heavily rely on peer review. If one major institution like the NIST is biased by the NSA, they will have a bigger chance of compromising algorithms if that are their intentions.
You'd be surprised what the world wide collective of Cryptographers are capable of when they're able to scrutinize a project in the first place. Which would you prefer? A closed unscrutinizable encryption algorithm or one that's entirely open from the ground up?
NIST could do damage if they're biased, but it's not like people aren't keeping a close eye on them and scrutinizing as many mistakes as possible. Especially for an algorithm as globally important as PQC.
I'm totally against anything proprietary. That's the first requisite for anything I use. And I'm not advocating for proprietary algorithms at all, that would be very much the demise of encryption.
I'm just worried that a sufficiently influent actor (let's say a government) could theoretically bribe these institutions to promote weaker encryption standards. I'm not even saying they are trying to introduce backdoors, just that like the article suggest they might bias organizations to support weaker algorithms.
AES 128 bits is still considered secure in public institutions, when modern computers can do much stronger encryption without being noticeable slower.
A huge amount of organization are already biased and using weaker algorithms… They just do so under the obscurity of proprietary software so it's much harder to scrutinize them.
Good luck with that. FOSS is transparency on a source code level, there's no obscurity they can hide their back door behind.
https://slashdot.org/story/420213
You realize nobody would know about this in the first place if it was Proprietary, right?
FOSS allows for whistleblowers, scrutiny, and audits. Proprietary 'security via obscurity' does not.
I'm perfectly aware of all that. but cryptography is an extremely complicated discipline that even the most experienced mathematicians have a hard time to design and scrutinize an algorithm, they heavily rely on peer review. If one major institution like the NIST is biased by the NSA, they will have a bigger chance of compromising algorithms if that are their intentions.
You'd be surprised what the world wide collective of Cryptographers are capable of when they're able to scrutinize a project in the first place. Which would you prefer? A closed unscrutinizable encryption algorithm or one that's entirely open from the ground up?
NIST could do damage if they're biased, but it's not like people aren't keeping a close eye on them and scrutinizing as many mistakes as possible. Especially for an algorithm as globally important as PQC.
I'm totally against anything proprietary. That's the first requisite for anything I use. And I'm not advocating for proprietary algorithms at all, that would be very much the demise of encryption.
I'm just worried that a sufficiently influent actor (let's say a government) could theoretically bribe these institutions to promote weaker encryption standards. I'm not even saying they are trying to introduce backdoors, just that like the article suggest they might bias organizations to support weaker algorithms.
AES 128 bits is still considered secure in public institutions, when modern computers can do much stronger encryption without being noticeable slower.
A huge amount of organization are already biased and using weaker algorithms… They just do so under the obscurity of proprietary software so it's much harder to scrutinize them.