bankinfosecurity.com has been spamming me on my work email, which I never provided to them, clearly having bought the address "somewhere". Please don't link to them, this rewards their shitty conduct.
Is there a cheap encrypted hand walkie-talkie can you buy and legally use in Europe? AES 128 bit? Last I checked you were only able to buy "privacy" radios (16-32 bit key).
This is unlikely. Amateur radio bands usage, for example, must very much not be encrypted, and my recollection is messages are supposed to be "of a personal or technical nature" according to ITU rules. i.e. there is regulation around not using radio for subverting states.
Within CB might be another story, but it would be highly likely to annoy other CB users.
> ...in defiance of a widely accepted cryptographic principle holding that obscurity is detrimental to security.
Security isn't my field, but my understanding is that this is a bit of a common misunderstanding re: Kerckhoff's Doctrine / Security through Obscurity.
The idea being that keeping something like a Cipher's algo secret is not necessarily detrimental to security, but that relying on obscurity to provide security rather than the merits of the algo is the problem.
Surely, opening the algo allows the community to audit it, but a group of experts sworn to secrecy can also do this (e.g. NSA's Suite A ciphers)
EDIT: I should add that opening TETRA is almost certainly a good idea if they can update it with help of the community.
10 comments
[ 3.5 ms ] story [ 33.9 ms ] threadhttps://www.etsi.org/newsroom/press-releases/2293-etsi-relea...
Within CB might be another story, but it would be highly likely to annoy other CB users.
But one can usually just buy a business band license for digital radios and then run DMR with AES256.
Security isn't my field, but my understanding is that this is a bit of a common misunderstanding re: Kerckhoff's Doctrine / Security through Obscurity.
The idea being that keeping something like a Cipher's algo secret is not necessarily detrimental to security, but that relying on obscurity to provide security rather than the merits of the algo is the problem.
Surely, opening the algo allows the community to audit it, but a group of experts sworn to secrecy can also do this (e.g. NSA's Suite A ciphers)
EDIT: I should add that opening TETRA is almost certainly a good idea if they can update it with help of the community.
We have no idea how many people/states broke TETRA before one made it public. And there is no feedback mechanism to get to know it either.
If the algorithm is out in the public, public research funding provides an incentive to publish findings, creating that missing feedback loop.