Finding flaw in cryptographic protocol

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
3
down vote

favorite
2












If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.

How about Finding a flaw in cryptographic protocol?!



  • How can you report it or flag an issue?

  • If you can fix it, is it possible to contribute?





encryption







share|improve this question

























    up vote
    3
    down vote

    favorite
    2












    If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.

    How about Finding a flaw in cryptographic protocol?!



    • How can you report it or flag an issue?

    • If you can fix it, is it possible to contribute?





    encryption







    share|improve this question























      up vote
      3
      down vote

      favorite
      2









      up vote
      3
      down vote

      favorite
      2






      2





      If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.

      How about Finding a flaw in cryptographic protocol?!



      • How can you report it or flag an issue?

      • If you can fix it, is it possible to contribute?





      encryption







      share|improve this question













      If you find a flaw or bug for example in Linux kernel you can create an issue in GitHub, or if you can solve it you can contribute.

      How about Finding a flaw in cryptographic protocol?!



      • How can you report it or flag an issue?

      • If you can fix it, is it possible to contribute?





      encryption




      encryption






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 5 hours ago









      R1w

      562222




      562222




















          2 Answers
          2






          active

          oldest

          votes

















          up vote
          2
          down vote













          First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



          Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



          1. Example RSA Dual_EC_DRBG .

          2. Example Heartbleed Bug





          share|improve this answer





























            up vote
            1
            down vote













            Or, you try to cash in on it.



            If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



            In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.






            share|improve this answer




















            • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
              – R1w
              3 mins ago










            Your Answer




            StackExchange.ifUsing("editor", function ()
            return StackExchange.using("mathjaxEditing", function ()
            StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix)
            StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
            );
            );
            , "mathjax-editing");

            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "281"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            convertImagesToLinks: false,
            noModals: false,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            noCode: true, onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













             

            draft saved


            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f62847%2ffinding-flaw-in-cryptographic-protocol%23new-answer', 'question_page');

            );

            Post as a guest

















            2 Answers
            2






            active

            oldest

            votes








            2 Answers
            2






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes








            up vote
            2
            down vote













            First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



            Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



            1. Example RSA Dual_EC_DRBG .

            2. Example Heartbleed Bug





            share|improve this answer


























              up vote
              2
              down vote













              First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



              Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



              1. Example RSA Dual_EC_DRBG .

              2. Example Heartbleed Bug





              share|improve this answer
























                up vote
                2
                down vote










                up vote
                2
                down vote









                First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



                Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



                1. Example RSA Dual_EC_DRBG .

                2. Example Heartbleed Bug





                share|improve this answer














                First of all, if the protocol is under use, you have to warn them before publicly announce. Otherwise, there can be very catastrophic results. First day attacks are very common.



                Demonstrating only the flaw is a half paper, with countermeasures you will have a good paper. Of course, you have to give time to people to deploy the countermeasures.



                1. Example RSA Dual_EC_DRBG .

                2. Example Heartbleed Bug






                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited 4 hours ago

























                answered 5 hours ago









                kelalaka

                711214




                711214




















                    up vote
                    1
                    down vote













                    Or, you try to cash in on it.



                    If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



                    In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.






                    share|improve this answer




















                    • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                      – R1w
                      3 mins ago














                    up vote
                    1
                    down vote













                    Or, you try to cash in on it.



                    If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



                    In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.






                    share|improve this answer




















                    • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                      – R1w
                      3 mins ago












                    up vote
                    1
                    down vote










                    up vote
                    1
                    down vote









                    Or, you try to cash in on it.



                    If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



                    In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.






                    share|improve this answer












                    Or, you try to cash in on it.



                    If you're any good at finding flaws, there is a lucrative (and legal) market in vulnerabilities and zero day exploits. All of the security agencies pay to get these, presumably under some form of non disclosure agreements/secrecy legislation. If you're really good, you should be able to sell the same exploit to multiple buyers. It depends on your contacts as to whether you are able to access this market though.



                    In the war on terror, it could literally be catastrophic to not exploit such flaws. Hawks would argue that it's your patriotic duty to pass such information onto the security agencies. It's to protect the children too. Or so the ideology goes. See US NOBUS policy.







                    share|improve this answer












                    share|improve this answer



                    share|improve this answer










                    answered 16 mins ago









                    Paul Uszak

                    6,08111332




                    6,08111332











                    • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                      – R1w
                      3 mins ago
















                    • I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                      – R1w
                      3 mins ago















                    I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                    – R1w
                    3 mins ago




                    I confused how legal is to sell zero-day exploit and what is the difference between selling it to those people or in darknet?
                    – R1w
                    3 mins ago

















                     

                    draft saved


                    draft discarded















































                     


                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f62847%2ffinding-flaw-in-cryptographic-protocol%23new-answer', 'question_page');

                    );

                    Post as a guest
































































                    Comments

                    Post a Comment

                    Popular posts from this blog

                    What does second last employer means? [closed]

                    Image
                    Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote -3 down vote favorite Say, for example I have worked in the following companies, Company A => 2010 - 2011 Company B => 2011 - 2012 Company C => 2012 - Till Date Company D => Have offer Now assume Company D is asking to submit documents from my second last employer. So from the list of companies given, which company would be qualified as second last employer? software-industry employer share | improve this question asked Aug 10 '14 at 5:16 Rajaprabhu Aravindasamy 559 1 6 13 closed as off-topic by Jim G., jmort253 ♦ Aug 11 '14 at 1:58 This question appears to be off-topic. The users who voted to close gave this specific reason: "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address...
                    Read more

                    Installing NextGIS Connect into QGIS 3?

                    Image
                    Clash Royale CLAN TAG #URR8PPP .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty margin-bottom:0; up vote 1 down vote favorite Just acquired free version of NEXTGIS and trying to install the plugin for QGIS. It tells me it was not designed for version 3 of QGIS. How do I set up the QGIS-NEXTGIS interface then? qgis qgis-plugins nextgis share | improve this question edited 3 hours ago PolyGeo ♦ 51.9k 17 77 233 asked 4 hours ago IanGS 16 4 New contributor IanGS is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct. add a comment  |  up vote 1 down vote favorite Just acquired free version of NEXTGIS and trying to install the plugin for QGIS. It tells me it was not designed for version 3 of QGIS. How do I set up the QGIS-NEXTGIS interface then? qgis qgis-plugin...
                    Read more

                    One-line joke

                    A one-liner is a joke that is delivered in a single line. A good one-liner is said to be pithy - concise and meaningful. [1] Comedians and actors use this comedic method as part of their act, e.g. Jimmy Carr, Tommy Cooper, Rodney Dangerfield, Norm Macdonald, Ken Dodd, Stewart Francis, Zach Galifianakis, Mitch Hedberg, Anthony Jeselnik, Milton Jones, Shappi Khorsandi, Jay London, Mark Linn-Baker, Demetri Martin, Groucho Marx, Dan Mintz, Emo Philips, Tim Vine, Steven Wright and Henny Youngman and Arnold Schwarzenegger. [ citation needed ] Many fictional characters are also known to deliver one-liners, including James Bond, who usually includes pithy and laconic quips after disposing of a villain. [ citation needed ] Examples "A baby seal walks into a club." "A dyslexic man walks into a bra." (Anonymous) "There are three types of people, those who can count and those who can't." "Venison's dear, isn't it?" (Jimmy Carr) "An escala...
                    Read more