Snake oil (cryptography)
In Cryptography, the term snake oil' [1] is used to refer to various products which use wildly extravagant claims to market appallingly bad cryptography.
For examples, see Dimitri Sklyarov's Defcon presentation [1] on e-book security. ZDnet describes some of these systems as "astonishingly inept cryptography software". One company advertised "the only software in the universe that makes your information virtually 100% burglarproof!"; their actual encryption was "XOR-ing each byte with every byte of the string “encrypted”, which is the same as XOR with constant byte". Another use Rot 13 encryption. Such systems are ludicrously weak, entirely worthless even against an attacker who uses only pencil and paper.
Warning signs
A few things are warning signs that a product is bogus, or at least should be treated as suspect. We cover only the most conspicuous here; for more complete lists see the references.
One indicator is extravagant claims: "unbreakable", "revolutionary", "military-grade". "hacker-proof", "breakthrough".
Another indicator is a lack of technical details or references to research literature. This violates Kerckhoffs' Principle; no algorithm can be trusted until it has been published and analysed. If a vendor does not reveal all the internal details of their system so that it can be analysed, then they do not know what they are doing; assume their product is worthless. Any reason they give for not revealing the internals can be ignored. The only exception would be a large government agency who have their own analysts. Even they might get it wrong; Matt Blaze found a flaw [2] in the NSA's Clipper chip within weeks of its internals becoming public.
References to one-time pads. Real one-time pads are provably unbreakable for certain attacks, but snake oil often claims unbreakability for things that are not actually one-time pads. There is some current research suggesting that certain techniques may offer equivalent security, but if the claim "just like a one-time pad" is made without reference to the specific research, one may be well-advised to look for a snake charmer.
External links
- Matt Curtin's Snake Oil FAQ [3] is the commonest reference.