Post #2386109
2026-01-06 13:05 UTC
#Applied #cryptography cannot solve a #security problem. It can only convert a security problem into a key-management problem.
Corollary: If you aren’t actually solving the key-management problem, your cryptography is strictly decorative. This is not only not helpful, it is actively harmful, because it gives users a false sense of security, leading them to skip other precautions they would have otherwise taken.
src: https://www.dlp.rip/decorative-cryptography
Replies (1)
-
@Ichinin@infosec.exchange 2026-01-06 13:27
@stf@chaos.social No, keys are not the problem. You need cross endpoint validation with certificates, the only side that does this at the moment is the client endpoint. If you have signing capability on both endpoints you can start signing keys and other session data. Servers in 99.99% of cases never-ever validates the client, unless we're talking extremely secure government systems with elaborate authentication schemes.