In message <87is48k1h2.fsf@snark.piermont.com>, "Perry E. Metzger" writes:

>There is a profession called "cryptographer" out there. They are the
>folks who try out these new ideas, and they fill lots of conference
>proceedings with their new ideas, including things like crypto modes
>designed specifically for disk encryption.


There is a world out here that's called the IT industry.

When they badly needed a new password scrambler nobody from that
cryptographic discipline could be bothered with a problem already
long since solved in their academic journals and the task fell to
a more or less random programmer in the end.

Today that algorithm, with all its flaws, seems to protect a very
good sized chunk of the passwords on the internet:  All cisco
routers, all FreeBSD systems, the majority of Linux systems etc etc
etc.

At the time where I wrote GBDE, the best that was offered was CGD (and
similar) and users (not cryptographers!) didn't trust it and history
have so far repeated.

I am not claiming that things couldn't be done smarter than GBDE,
but I do notice an distinct lack of attempts to do so from the
cryptographic establishment.

I can add another property of the elite society of cryptographers:
if you are not a card carrying member of their society, the majority
of their members can not even be bothered to reply to an email from
an outsider.  This does hamper communiation a bit.

Maybe the problem is that cryptographers, like true computer
scientists, write in nothing less portable than pencil number two ?

If some card-carrying member of the cryptographic establishment were
to offer the Open Source operating systems an implementation which
were approved by all (or some qualified quorum of) the high priests
of their brother hood, then I am sure that it would be received with
praise and thanks of no end.

Poul-Henning

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.