Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Cryptography cannot be separated from authentication

Frequently repeated but still wrong. Cryptography requires one of the following: 1. Two key pairs, or 2. A shared secret.

The shared secret implies authenticity. But there are entire classes of cryptosystems based on not knowing with whom you are communicating. Crypto establishes a channel through which Alice and Bob can then negotiate authenticity. (To put it in simple terms: it's better to be phished over secure transport than to be phished over plaintext.)

For some reason, a large number of people seem to have completely skipped over this basic advantage of unauthenticated channels: you have now isolated the communication to you and your prospective phisher. This is a gain, this is an advantage, and it borders on absurd that people go to such lengths to deny this.



>> Cryptography cannot be separated from authentication

> Frequently repeated but still wrong.

> The shared secret implies authenticity.

Just checking: are you aware of the concept of authenticated encryption (https://en.wikipedia.org/wiki/Authenticated_encryption) and its importance?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: