<< | Thread Index | >> ]    [ << | Date Index | >> ]

To: Jake Appelbaum <jacob,AT,appelbaum,DOT,net>
Subject: Re: My response to both the analysis of CIPE by Gutmann, Slashdot and the response by the CIPE list
From: Damion Wilson <dwilson,AT,ibl,DOT,bm>
Date: Thu, 25 Sep 2003 10:57:36 -0300
Cc: cipe-l,AT,inka,DOT,de
In-reply-to: <1064495379.428.21.camel@eris>
References: <1064495379.428.21.camel@eris>

I don't have a problem with a cryptanalyst providing an appraisal of our 
project, in fact I welcome it. However, I do have a problem with that same 
cryptanalyst deciding, in 15 minutes or less, that the design goals of a 
project constitute "serious flaws" in implementation. Furthermore, I think 
that just because someone of Peter Gutmann's reputation and stature stands up 
and provides a list of "fixes" for a project doesn't mean that everything on 
said list is necessary, important, or even correct.

This situation for us is not unlike the Hallowe'en documents re: Linux some 
years back. They did provide some insight into how Linux and Samba could be 
improved, but they were hardly an itemised todo list.

Should we abandon the project just because he said we should ? That was the 
tone which emanated from his original posting, not one of improvement.

I understand that you are not a cryptanalysis expert nor a VPN developer, but 
you still appear to accept Peter Gutmann's analysis as definitive. By 
imploring us to "get this fixed" based solely on his appraisal is insulting, 
not helpful.


On Thursday 25 September 2003 10:09 am, Jake Appelbaum wrote:
> Please allow me to introduce myself.
> I am neither a CIPE developer nor a cryptanalysis expert.
> I am however a security consultant who deals primarily in Free/Open
> Source Software. I have used CIPE in the past as well as other
> Free/Open/Non-Free products for use in a VPN solutions.
> I wanted to contribute an outsiders perspective.

<< | Thread Index | >> ]    [ << | Date Index | >> ]