Hacker News new | past | comments | ask | show | jobs | submit login

That's cryptography at its frontiers: you look at progress and try to get a sense of where it's going to take you. It's why Schneier keeps pounding on "attacks only get better".

Also, as layperson, you should be wary of the lesson the last two decades have taught people like you on responding to far-out attacks on algorithms. RC4 was known to be broken almost immediately after it was published, but it wasn't until a few months ago(!) that someone bothered to refine the attack to the point where it could break TLS.

The industry's intuition about how likely it is that a "theoretical" flaw will be weaponized is probably wrong. Crypto as a discipline only came into its own within the last ~10 years, and it's safe to assume offensive crypto research has lagged behind it.




This is the third time in a short while I've seen (not random) people say RC4 is broken, so I went and looked it up, and I'm glad I did -- I guess you're referring to this:

http://www.isg.rhul.ac.uk/tls/

I wasn't aware of these weaknesses in RC4 - I thought most of the "RC4 is broken"-comments were WEP fallout/hyperbole -- I guess it really wasn't!

On a side note - shouldn't RC4 in TLS be even more vulnerable to CRIME than block ciphers?


RC4 is so broken. It's comically broken. It's amazing that it made it to 2013.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: