<div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Apr 30, 2017 at 9:56 PM, Peter Gutmann <span dir="ltr"><<a href="mailto:pgut001@cs.auckland.ac.nz" target="_blank">pgut001@cs.auckland.ac.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">Phillip Hallam-Baker <<a href="mailto:phill@hallambaker.com">phill@hallambaker.com</a>> writes:<br>
<br>
>My two daily driver cars are a couple of Jaguar convertibles built in 1999.<br>
>They are surprisingly reliable<br>
<br>
>My two daily driver cars are a couple of Jaguar convertibles built in 1999.<br>
>They are surprisingly reliable<br>
<br>
</span>That's not necessarily a ringing endorsement, "for Jaguars (something where<br>
Lucas Electric was involved), they are surprisingly reliable". That's like<br>
"this Windows server has an uptime of nearly two weeks" or "I actually got a<br>
second day of battery life for my phone the other day". </blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">The electrics are all made in Germany,</div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> So<br>
getting back to the OP, there's hardware out there that not only can be<br>
trusted beyond ten years, it'd be regarded as defective if it didn't last ten<br>
years. Or twenty. Or thirty.<br></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">My MGB does have Lucas electrics, being essentially relay based the reliability is poor but the repairability is high.</div><br></div><div><div class="gmail_default" style="font-size:small">The reason I don't want to trust my keys to a black box is that I have no way to repair it. However low the probability of a fault is, there is no way to recover from it.</div><br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Or, in the case of relay ladder logic controllers, eighty or a hundred.<br>
<br>
This sort of life cycle is more or less impossible for crypto people to<br>
understand [1]. Conversely, SCADA/industrial control people understand the<br>
life cycle but not crypto. This is why we have so much SCADA gear that's an<br>
OWASP top-ten antipattern<br></blockquote><div><br></div><div><div class="gmail_default" style="font-size:small">I used to be a control engineer.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">It isn't really the case that control systems were expected to last a hundred years. Most would be ripped out and replaced on a regular basis. But they are designed in a very different way to most network software. They don't use encryption because they want every signal to be observable. But they are very interested in adding authentication.</div></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">In their world it isn't</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Confidentiality Integrity Availability</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">It is:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Confidentiality << Integrity < Availability<br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div></div></div></div>