People who are more cryptography-literate than I am: is this a real thing? My immediate inclination is to be skeptical of anything claiming to be hacker-proof, but I don't have the math skills to back it uphttps://twitter.com/QuantaMagazine/status/1152299326481358849 …
-
-
Replying to @IanColdwater
formal methods verification is no panacea (and that headline is hype), but its v useful in designing & testing crypto state machines and things like parsing network payloads & handshakes (X.509, ASN.1, ECDH). Orgs like
@galois &@trailofbits have done critical applied work here.1 reply 0 retweets 27 likes -
Replying to @kennwhite @IanColdwater and1 reply 0 retweets 2 likes
-
Replying to @kennwhite @IanColdwater and
Regardless of whether the spec or the verification technique is perfect, verifying code dramatically reduces the scope of what can go wrong and makes a manual review that much more effective. I'm not sure why the industrial security community has been a frequent naysayer.
4 replies 0 retweets 17 likes -
Replying to @dguido @kennwhite and
We use verification techniques
@trailofbits to eliminate categories of flaws + more efficiently focus our time on logical or more abstract risks. Verifying code also necessitates conversations with developers about their intent, sometimes the single most important outcome.1 reply 0 retweets 7 likes
Being forced to write out the critical security properties for your code in a machine-parseable format, then using a tool to watch your back for failures of them is never a bad thing!
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.