[Cryptography] Checking for the inadvertent use of test keys

Peter Gutmann pgut001 at cs.auckland.ac.nz
Thu Sep 3 01:53:58 EDT 2015

Several people have suggested, on-list and off, checking against common known-
bad strings and/or patterns.  Unfortunately this gets back to the epicycles
approach I mentioned in my original message, you need a priori knowledge of
likely values for test keys in order to be able to detect them and warn when a
test key may be being used in production.

One off-list contributor mentioned the following:

  Opening up a philosophical discussion here, but wouldn't that be like trying
  to find the smallest uninteresting number? Being the smallest, it would have
  an interesting property and thus be no longer eligible for the job.

which makes a good point, that it may be an unsolvable problem in general,
that identifying inadvertently-used test keys may require an algorithm
implementing the Potter Stewart "I'll know it when I see it" test.

So for now I've left things at the ad-hoc level, checking for ASCII strings,
strings where value n+1 differs from value n by a small amount, that sort of
thing.  It's not meant to be a bulletproof test, just something to ask the
user "are you sure this is what's meant to be used as a key".


More information about the cryptography mailing list