The wisdom of the ill informed

[James A. Donald]

Arshad Noor wrote:
> While programmers or business=people could be ill-informed, Allen,
> I think the greater danger is that IT auditors do not know enough
> about cryptography, and consequently pass unsafe business processes
> and/or software as being secure.

Committees of experts regularly get cryptography wrong - consider, for 
example the Wifi debacle.  Each wifi release contains classic and 
infamous errors - for example WPA-Personal is subject to offline 
dictionary attack.

One would have thought that after the first disaster they would have 
hired someone who could do it right, but as Ian long ago pointed out, in 
"the market for silver bullets", they are unable to tell who can do it 
right.  The only people who know who the real experts are, are the real 
experts.   If you knew who to hire, you could do it yourself, and 
probably should do it yourself.  So they hire expert salesmen, not 
cryptography experts.

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com