You're flat-out wrong about #3. Encryption is just a mathematical algorithm, it doesn't care who uses it, only that you have the key.
In short, encryption is just a very complex function, so you feed Key + Message in, and you get an Output. f(K,M) = O
I already have access to Key and Message, so I can share both of those. The only thing you can possibly secure is f().
If you have a cryptographic program, like OTR, I can just decompile it and get f(), and then post a modified version that lets the user manually configure their key (I think this is actually trivial in OTR, but it's been years since I poked at it)
If it's a website where I login and it auto-decrypts things for me, then I can just send someone the URL and the key I use.
Point 2 seems to reply on Point 3, and as far as I'm aware the only formally mathematically provably deniable method WHEN THE KEY IS COMPROMISED is a one-time pad.
I'm not sure how much crypto experience you have, but "and no one else knows the key" is a foundation of every algorithm I have ever worked on, and I'm reasonably confident that it's a mathematical requirement. I simply cannot imagine how you could possibly write a crypto algorithm that is secure EVEN with a compromised key.
EDIT: If you still think I'm wrong, can you please give me a sense of your crypto experience? For reference: I've met with the people who wrote OTR and hang out in a number of crypto circles, but only do fairly basic stuff in my actual work. I do still have a hobby interest in it, and follow it, but the last time I did any serious code breaking was about a decade ago.
Subscribe to RSS Feed
= f037147d6e6c911a85753b9abdedda8d)
Which category is it if you decide based on multiple factors, ONE of which is PR? And why is this a bad thing, if that's what you believe?
Before I spend any more time replying to this, can you clarify for me... do you and I actually disagree about something of substance here? I.e. how an organization should, in the real world, deal with PR concerns? Or are we just arguing about the most technically correct way to go about stating our position?