Why cryptosystems fail
Ross Anderson · Communications of the ACM · 1994
Fail ryptography is used by governments, banks, and other or-ganizatiom to keep messages secret and to protect electronic transactions from modification.It is basically an engineering discipline, but differs in a rather striking way from, for example, aeronautical engineering: there is almost no public feedback about how cryptographic systems fail.Commercial airline crashes are extremely public events.Investigators rush to the scene, and their inquiries involve experts from a wide range of interestsfrom the carrier, through the manufacturer, to the pilots' union.Their findings are examined byjournalisrs and politicians, discussed on electronic bulletin boards and in pilots' messes, and passed on by flying instructors.This learning mechanism is the main reawn why, despite the inherent hazards of flying, the risk of an individual being killed on a scheduled air journey is only about one in a million.Cryptographers rarely get this kind of feedback, and indeed the history of the subject shows the same mistakes being made over and over again.For example, Norway's rapid fall in the Second World War was largely due to the Germans' success in solving British naval codesusing exactly the same techniques that the Royal Navy's own "Room 40" had used against Germany in the previous war [ 161.Altbough we now have a reasonable history of cryptology up to the end of World War II, a curtain of silence has descended on government-sector use of this technology since then.Although this is not particularly surpris ing, it does leave a large experience deficit, especially as the introduction of.computers since 1945 has changed the situation considerably.It is as ifaccident reports were only published for pistonengined aircraft, while the caw es of all jet-aircraft crashes were kept a state secret.This secrecy is no longer appropriate, a~ military messaging networ!~ now make up only about 1% of the world's crptography, whether we measure this by the number of users or by the number of terminals.There are some civilian applications for secure messaging, such as interbank money transfer and burglar alarm signaling; but the great majority of fielded cryptographic