As an attacker of (...) intelligence, key management is the place I look first in security protocols for failures, because both lay developers and crypto engineers tend to make more mistakes there than anywhere else in crypto protocols.
back
1 comments
More than half of the crypto schemes I've looked at in the last 2 years have used ECB mode. Of the very few systems that used CTR mode, two of them had colliding nonces. Less than half of the systems I see have explicit MACs. Some of the most popular systems in the world have had padding oracles (see the recent drama around JSF, and note SSH fell to this too). Three SRP systems I've had to evaluate have had the (thanks, Nate and Trevor) zero-mod-n problem. Nate and Coda Hale have found multiple famous systems, with HMAC MACs, that are trivially timeable.
No. Key management isn't the problem. Key management is what people bring up when they mean "I haven't really looked at the underlying crypto very carefully". It's a punt answer that leaves people feeling warm and fuzzy about actual cryptography, when actual cryptography is likely as not to be the thing that actually kills you.