Conversation

Notices

1. Embed this notice
   Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Saturday, 09-Dec-2023 21:39:14 JST Haelwenn /элвэн/ :triskell:
   > Kerckhoffs's principles in «La Cryptographie Militaire» (1883)
   > 3. It must be possible to communicate and remember the key without using written notes, and correspondents must be able to change or modify it at will;
   
   So basically key rotation, meaning that some implementers have built known-broken systems before their grandparents were born.
   Not having to write down the key is maybe a bit historic these days, but it's a reminder that your private keys should be encrypted and with good protection against dumps (like via a smartcard/HSM).
   
   > 6. Lastly, given the circumstances in which it is to be used, the system must be easy to use and should not be stressful to use or require its users to know and comply with a long list of rules.
   
   Yup, good security is user-centric, otherwise it gets broken by the human element.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Saturday, 09-Dec-2023 23:08:26 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • geb
     @geb Yup, but I think the spirit of it is more about preventing the key from being leaked/copied, that said not having it written down in the first place means it fundamentally can't.
     I think a modern version would be at least tamper-evidence.
   • Embed this notice
     geb (geb@mamot.fr)'s status on Saturday, 09-Dec-2023 23:08:27 JST geb

     in reply to

     @lanodan In these days, the average key size, may not have been exactly the same one as today :)