Snake oil (cryptography)

From Citizendium
Revision as of 12:18, 25 October 2008 by imported>Sandy Harris
Jump to navigation Jump to search
This article is developing and not approved.
Main Article
Discussion
Related Articles  [?]
Bibliography  [?]
External Links  [?]
Citable Version  [?]
 
This editable Main Article is under development and subject to a disclaimer.

In Cryptography, the term snake oil [1] is used to refer to various products which use wildly extravagant marketing claims to promote appallingly bad cryptography.

For examples, see Dimitri Sklyarov's Defcon presentation [1] on e-book security. ZDnet [2] called some of these systems "astonishingly inept cryptography software". One company advertised "the only software in the universe that makes your information virtually 100% burglarproof!"; their actual encryption was "XOR-ing each byte with every byte of the string “encrypted”, which is the same as XOR with constant byte". Another used Rot 13 encryption. These systems are ludicrously weak, utterly worthless even against an attacker who uses only pencil and paper.

The name "snake oil" comes from 19th Century medicine shows selling various "miracle cures"; snake oil was a common ingredient. It still appears on ingredients lists for medicinal products in China.

  1. Bruce Schneier (February 1999). Snake Oil. Counterpane Inc..