Finding flaw in cryptographic protocol

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
3
down vote

favorite
2












If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.

How about Finding a flaw in cryptographic protocol?!



  • How can you report it or flag an issue?

  • If you can fix it, is it possible to contribute?





encryption







share|improve this question

























    up vote
    3
    down vote

    favorite
    2












    If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.

    How about Finding a flaw in cryptographic protocol?!



    • How can you report it or flag an issue?

    • If you can fix it, is it possible to contribute?





    encryption







    share|improve this question























      up vote
      3
      down vote

      favorite
      2









      up vote
      3
      down vote

      favorite
      2






      2





      If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.

      How about Finding a flaw in cryptographic protocol?!



      • How can you report it or flag an issue?

      • If you can fix it, is it possible to contribute?





      encryption







      share|improve this question













      If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.

      How about Finding a flaw in cryptographic protocol?!



      • How can you report it or flag an issue?

      • If you can fix it, is it possible to contribute?





      encryption




      encryption






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 5 hours ago









      R1w

      562222




      562222




















          2 Answers
          2






          active

          oldest

          votes

















          up vote
          2
          down vote













          First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



          Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



          1. Example RSA Dual_EC_DRBG .

          2. Example Heartbleed Bug





          share|improve this answer





























            up vote
            1
            down vote













            Or, you try to cash in on it.



            If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



            In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.






            share|improve this answer




















            • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
              – R1w
              3 mins ago










            Your Answer




            StackExchange.ifUsing("editor", function ()
            return StackExchange.using("mathjaxEditing", function ()
            StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix)
            StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
            );
            );
            , "mathjax-editing");

            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "281"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            convertImagesToLinks: false,
            noModals: false,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            noCode: true, onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













             

            draft saved


            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f62847%2ffinding-flaw-in-cryptographic-protocol%23new-answer', 'question_page');

            );

            Post as a guest

















            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes








            up vote
            2
            down vote













            First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



            Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



            1. Example RSA Dual_EC_DRBG .

            2. Example Heartbleed Bug





            share|improve this answer


























              up vote
              2
              down vote













              First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



              Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



              1. Example RSA Dual_EC_DRBG .

              2. Example Heartbleed Bug





              share|improve this answer
























                up vote
                2
                down vote










                up vote
                2
                down vote









                First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



                Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



                1. Example RSA Dual_EC_DRBG .

                2. Example Heartbleed Bug





                share|improve this answer














                First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



                Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



                1. Example RSA Dual_EC_DRBG .

                2. Example Heartbleed Bug






                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited 4 hours ago

























                answered 5 hours ago









                kelalaka

                711214




                711214




















                    up vote
                    1
                    down vote













                    Or, you try to cash in on it.



                    If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



                    In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.






                    share|improve this answer




















                    • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                      – R1w
                      3 mins ago














                    up vote
                    1
                    down vote













                    Or, you try to cash in on it.



                    If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



                    In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.






                    share|improve this answer




















                    • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                      – R1w
                      3 mins ago












                    up vote
                    1
                    down vote










                    up vote
                    1
                    down vote









                    Or, you try to cash in on it.



                    If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



                    In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.






                    share|improve this answer












                    Or, you try to cash in on it.



                    If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



                    In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.







                    share|improve this answer












                    share|improve this answer



                    share|improve this answer










                    answered 16 mins ago









                    Paul Uszak

                    6,08111332




                    6,08111332











                    • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                      – R1w
                      3 mins ago
















                    • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                      – R1w
                      3 mins ago















                    I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                    – R1w
                    3 mins ago




                    I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                    – R1w
                    3 mins ago

















                     

                    draft saved


                    draft discarded















































                     


                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f62847%2ffinding-flaw-in-cryptographic-protocol%23new-answer', 'question_page');

                    );

                    Post as a guest
































































                    Comments

                    Post a Comment

                    Popular posts from this blog

                    Long meetings (6-7 hours a day): Being “babysat” by supervisor

                    Image
                    Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote 31 down vote favorite 4 I hold a PhD in mechanical engineering with a 7 year background in self-guided, self-paced research including 2 years as a graduate level course instructor and a subject matter expert for various engineering projects in a university setting in the United States. For the last 10-11 months, I am working in a research industry in France where my task is to debug C++ spaghetti code written over a period of several years by my current supervisor. It is a team of 2: just I and my supervisor. Diurnally, I am posed with a "bug of the day" to get out of this C++ code. My supervisor generally gives me about 15-30 minutes to solve it and then accosts me about whether or not the task is completed and then rinses and repeats this until the end of the day. Off-late, my supervisor has been holding 6-7 hour long "meetin
                    Read more

                    Is the Concept of Multiple Fantasy Races Scientifically Flawed? [closed]

                    Image
                    Clash Royale CLAN TAG #URR8PPP up vote 2 down vote favorite Many fantasy worlds have multiple humanoid species (elves, orcs, humans, etc) living in the same world, in addition to that, they often have the ability to interbreed. And I can't help but question their believability... fantasy-races reproduction interspecies-relations share | improve this question edited Aug 9 at 14:46 Michael Kjörling ♦ 21.1k 10 85 161 asked Aug 9 at 13:13 Chlodio 118 6 closed as unclear what you're asking by MichaelK, Gryphon, John, Vincent, Frostfyre Aug 9 at 15:25 Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question. 3 Stack Exchange exist to
                    Read more

                    Confectionery

                    Image
                    Prepared foods made with a lot of sugar or other cabohydrates "Sweetmeat" redirects here. For the racehorse, see Sweetmeat (horse). Not to be confused with Sweetbread. This Kransekake is a traditional Scandinavian baker's confection. Confectionery is the art of making confections , which are food items that are rich in sugar and carbohydrates. Exact definitions are difficult. [1] In general, though, confectionery is divided into two broad and somewhat overlapping categories, bakers' confections and sugar confections. [2] Bakers' confectionery, also called flour confections , includes principally sweet pastries, cakes, and similar baked goods. Sugar confectionery includes candies ( sweets in British English), candied nuts, chocolates, chewing gum, bubble gum, pastillage, and other confections that are made primarily of sugar. In some cases, chocolate confections (confections made of chocolate) are treated as a separate category, as are sugar-free versions of
                    Read more