Path: csiph.com!usenet.pasdenom.info!news.redatomik.org!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
MIME-Version: 1.0
In-Reply-To: <mmlp42$p4v$1@news.albasani.net>
References: <mmcagn$aa5$1@ger.gmane.org> <q67loadve6lsrh672u47omr04tvqttt6jd@4ax.com> <mailman.29.1435170987.3674.python-list@python.org> <558b7e85$0$1648$c3e8da3$5496439d@news.astraweb.com> <mailman.42.1435206516.3674.python-list@python.org> <558bc912$0$2899$c3e8da3$76491128@news.astraweb.com> <slrnmonkip.1nu.jon+usenet@frosty.unequivocal.co.uk> <558c1a7e$0$1668$c3e8da3$5496439d@news.astraweb.com> <slrnmoo7ev.1nu.jon+usenet@frosty.unequivocal.co.uk> <CAPTjJmqOzLTv9cFFKjV-BLtaFZhEZ4B870ALqNMmanCEN-VqXA@mail.gmail.com> <mailman.89.1435280528.3674.python-list@python.org> <558d86b0$0$1659$c3e8da3$5496439d@news.astraweb.com> <mailman.111.1435349412.3674.python-list@python.org> <558e1ac6$0$1675$c3e8da3$5496439d@news.astraweb.com> <mailman.121.1435384091.3674.python-list@python.org> <558e610f$0$1648$c3e8da3$5496439d@news.astraweb.com> <mailman.130.1435395217.3674.python-list@python.org> <mmlp42$p4v$1@news.albasani.net>
Date: Sat, 27 Jun 2015 19:17:16 +1000
Subject: Re: Pure Python Data Mangling or Encrypting
From: Chris Angelico <rosuav@gmail.com>
Cc: "python-list@python.org" <python-list@python.org>
Content-Type: text/plain; charset=UTF-8
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.131.1435396645.3674.python-list@python.org>
Lines: 40
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:93234

On Sat, Jun 27, 2015 at 7:07 PM, Johannes Bauer <dfnsonfsduifb@gmx.de> wrote:
> On 27.06.2015 10:53, Chris Angelico wrote:
>> On Sat, Jun 27, 2015 at 6:38 PM, Steven D'Aprano <steve@pearwood.info> wrote:
>>> I'm not a security expert. I'm not even a talented amateur. *Every time* I
>>> suggest that "X is secure", the security guy at work shoots me down in
>>> flames. But nicely, because I pay his wages <wink>
>>
>> Just out of interest, is _anybody_ active in this thread an expert on
>> security?
>
> Yes. I've done a good 10 years of work in the field doing security
> (mostly applied cryptography on embedded systems with a focus on side
> channels like DPA, but also security concepts and threat/risk analysis)
> and spent the last 3-4 years working on my PhD in the field of IT
> security. My thesis is almost(tm) finished. I would claim to be an
> expert, yes.

Good, so this isn't like that episode of Yes Minister when they were
trying to figure out whether to allow a chemical factory to be built.

>> I certainly am not, which means that the proposal I'm
>> currently putting together probably has a whole bunch of
>> vulnerabilities that I haven't thought of. (Though there's no emphasis
>> on encryption anywhere, just signing. I'm *hoping* that RSA public key
>> verification is sufficient, but if it isn't, it would be possible for
>> a malicious user to make a serious mess of stuff.) But I'm under no
>> delusions. I don't say "this is secure" - all I'm saying is "this
>> works in proof-of-concept".
>
> I must admit that I haven't seen your ideas in this thread?

No, the proposal I'm putting together is unrelated. You'll see the
*vast* extent of my security skills here:

https://github.com/Rosuav/ThirdSquare

My contribution to this thread has been fairly minor, just suggesting
one attack that doesn't even work any more, not much else.

ChrisA