Re: setsppfp bug

> might it be prudent to issue a lockdown dmpsysobj msg...but then, how to
> do so sans creating a helluva mess???
>


Let me quote from "Applied Cryptography" by Bruce Schneier:
"If I take a letter, lock it in a safe, hide the safe somewhere in New York,
then tell you to read the letter, that is not security, That's obscurity.
On the other hand, if I take a letter and lock it in a safe, and then give
the safe along with the design specifications of the safe and a hundred
identical safes with their combinations so that you and the world's best
safecrackers can study the locking mechanism - and you still cannot
open the safe and read the letter - that's security" .

So, according to Bruce, the AS/400 has obscurity, not security.

A fundamental tenet in cryptoanalysis, first enunciated by the Dutchman
Kerckhoffs in the nineteenth century, is that all security must reside
entirely
in the key and none is inherent in knowledge of the algorithm. Bruce again:
"If the strength of your new cryptosystem relies on the fact the attacker
does not know the algorithm's inner workings, you're sunk. If you believe
that keeping the algorithm's insides secret improves the security of your
cryptosystem more than letting the [.] community analyze it, you're wrong.
And if you think that someone won't disassemble your code and
reverse-engineer your algorithm, you're naïve. The best algorithms we
have are the ones made public, that have been attacked [.] for years,
and are still unbreakable" .

IBM's attempt to be secretive about AS/400 internals, does not lead
to a secure system.



+---
| This is the MI Programmers Mailing List!
| To submit a new message, send your mail to MI400@midrange.com.
| To subscribe to this list send email to MI400-SUB@midrange.com.
| To unsubscribe from this list send email to MI400-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: dr2@cssas400.com
+---