Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is interesting news, but even if your software uses AES, there's nothing actionable in it for you.

You are 10,000x more likely to get busted up by a flaw in how you use a cipher than you are by a flaw in what your cipher is. You could use TEA, and it would still be overwhelmingly likely that your code would fail before the algorithm did.

In fact, anything you did to react to news like this would probably make you less secure. That's because AES has overwhelming library support, and whatever "stronger" cipher you might think of adopting won't. That means you'll have more DIY code, and more poorly reviewed library code, all with a bunch of implementation flaws lurking under the surface.



This is good advice, but don't let it talk you out of upgrading a library. System administration is still actionable in these cases.


Agreed. Moreover. If your software requires a source code change because something happened in cryptography research, you've probably done something wrong.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: