Some time ago I came across a Novel published in 1998 that was about a flaw in ANSI X9.17.
I feel like everyone in a field related to encryption should read it. That's why I've resurrected The Electronic Money Mill in a way that is more suited for the devices of the year 2017. The original publication is down and can be found with the way back machine and the original author went MIA.

 

Some time ago I came across a Novel published in 1998 that was about a flaw in ANSI X9.17.
I feel like everyone in a field related to encryption should read it. That's why I've resurrected The Electronic Money Mill in a way that is more suited for the devices of the year 2017. The original publication is down and can be found with the way back machine and the original author went MIA.

I'm not sure why you feel the way you do. Are you suggesting that there is a flaw, or only that this is an apocryphal tale about what could happen?

 

I'm not sure why you feel the way you do. Are you suggesting that there is a flaw, or only that this is an apocryphal tale about what could happen?

From the short description left by the original author the described flaw is real but the scenario is fictional. I don't think the described flaw is still relevant nowadays. So the novel is relevant in multiple ways.

1. It describes a flaw in a real world standard
2. It describes what could happen when such a flaw gets out into the wild
3. It builds some basic understanding of encryption and it's potential issues.

 

From the short description left by the original author the described flaw is real but the scenario is fictional. I don't think the described flaw is still relevant nowadays. So the novel is relevant in multiple ways.

1. It describes a flaw in a real world standard
2. It describes what could happen when such a flaw gets out into the wild
3. It builds some basic understanding of encryption and it's potential issues.

The reason I asked is that I served on an ANSI standards committee once upon a time. Not the one referenced in post #1 of course, but one involving interface standards for disk drives. There were mechanisms for handling flaws discovered after draft standards had been approved at each stage of the process.

 

Yeah the mechanisms you're talking about are in place for sure but they take time to adopt to the situation. When you have do deal with the issue in production implementations a lot of time can pass till the situation is resolved. In the example the flaw is used to create financial transactions that go unnoticed for quite some time. So the conclusion might be that you have to be on the watch out even when dealing with standards.