As I’ve become slightly less ignorant about information security and encryption, I’ve noticed a disturbing trend: vagueness. Okay, so maybe that should be unsurprising, but it’s a serious problem in this context. As an example, here’s something Sony said about the recent attack on the PSN:
The entire credit card table was encrypted and we have no evidence that credit card data was taken.
My questions are: what does it even mean for the “entire table” to be “encrypted”? What algorithm did they use? Was it strong? And if so, where was the key? What steps were taken to protect this key? They may have used AES or RSA with a key stored securely on a server located elsewhere from the credit card table. But then again, they may not have. They may have stuffed it in a table next to the credit card table where anyone with read access to the DB could grab it. This is like having a door which is locked, with the key hanging on a chain next to the lock. The point is, we don’t know which one these they did; we just know it was “encrypted”.
Sony’s not the only one guilty of this. Microsoft just recently announced a new wireless keyboard and mouse which “features Advanced Encryption Standard (AES), which can help protect your personal and business information by encrypting what you type”. Hey! They at least told us the algorithm they used; and they used a good one at that! But this is still not enough. Again there is no mention of the key; how it is exchanged or stored. They could perhaps pair the device and its receiver at manufacture-time, which would be secure. Or they could send the keys across in the clear. Or they could all share a global key. Even if they get that right, if they don’t append a salt to the scan code before sending it, they’re basically using a substitution cipher. Maybe they do this, maybe they don’t. But in the end, we don’t know what it does, we just know it’s “encrypted”.
It doesn’t have to be like this. Tarsnap is an exceedingly excellent counter-example, with thorough descriptions of both the overall security design and the cryptography. KeePass is another good example of proper security documentation. Both programs are also open source, which is a bonus. It’s good to know that if I place my data in the care of these programs, it will be encrypted, not just “encrypted”.