🚀 go-pugleaf

smb@research.att.com (Steven Bellovin) writes:

>In article <1992Dec30.121120.736@uoft02.utoledo.edu>, cscon0151@uoft02.utoledo.edu writes:
>> I've heard the designers of DES made the code too difficult.  The NSA, which
>> apparently has to approve the encryption format,  thought that code was too
>> difficult, and purposely flawed the encryption standard.  That's what the
>> people in sci.crypt told me (I think it was them).  Anyways, the sci.crypt
>> newsgroup has some good info about DES and DVP,  at least they did a couple
>> months ago.

>Yup, sci.crypt is the right newsgroup for this question, and I've redirected
>followups to that group.  But since the question keeps coming up...
*** Lots of good stuff I agree with deleted. ***

DES is certainly good eough for any application that does not interest
a government.  If a government is interested in decrypting any information
you have, you should consult a professional.  I have no idea how you might
get in touch with one.

One other point, any examination of the open literature regarding
protection of sensitive information reveals that the easiest way to get
access to that information is by corrupting someone with access.  In
commercial endeavors, this is frequently very easy since only money and
honor are involved.  Other popular methods are illegal entry and bugging
of various types.  None of these techniques require any cryptographic
capability.  (When was the last time you checked your mechanical pencil
to see if it was bugged.)

The crypto system is frequently the strongest link in a weak protection
scheme.  Lots of idiots and a few good cryptologists have looked at DES
and no one has come up with any easy way to crack it.