<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Sep 6, 2013, at 6:13 AM, Jaap-Henk Hoepman <<a href="mailto:jhh@cs.ru.nl">jhh@cs.ru.nl</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div dir="auto"><div><span></span></div><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="-webkit-text-size-adjust: auto; ">In this oped in the Guardian</div><div style="-webkit-text-size-adjust: auto; "><br></div><div style="-webkit-text-size-adjust: auto; "><a href="http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance">http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance</a></div><div style="-webkit-text-size-adjust: auto; "><br></div><div style="-webkit-text-size-adjust: auto; ">Bruce Schneier writes: "<span style="background-color: rgba(255, 255, 255, 0); ">Prefer symmetric cryptography over public-key cryptography." The only reason I can think of is that for public key crypto you typically use an American (and thus subverted) CA to get the recipients public key. </span></div><div style="-webkit-text-size-adjust: auto; "><span style="background-color: rgba(255, 255, 255, 0); "><br></span></div><div style="-webkit-text-size-adjust: auto; "><span style="background-color: rgba(255, 255, 255, 0); ">What other reasons could there be for this advice?</span></div></div></div></blockquote><br></div><div>Public-key cryptography is less well-understood than symmetric-key cryptography. It is also tetchier than symmetric-key crypto, and if you pay attention to us talking about issues with nonces, counters, IVs, chaining modes, and all that, you see that saying that it's tetchier than that is a warning indeed.</div><div><br></div><div>The magic of public key crypto is that it gets rid of the key management problem -- if I'm going to communicate with you with symmetric crypto, how do I get the keys to you? The pain of it is that it replaces it with a new set of problems. Those problems include that the amazing power of public-key crypto tempts one to do things that may not be wise.</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Jon</div><div><br></div><br></body></html>