Secure HTTPS web pages that were protected only by encryption would give you a dreadfully false sense of security when doing online banking: there’s no point in being on a strongly-encrypted internet connection if you’re talking to a crook at the other end.Īuthentication over the internet is usually achieved using what are known as digital signatures, based on public-key cryptography, for example using the RSA algorithm. Secure internet protocols such as TLS, previously known as SSL, are designed to provide encryption (keep your conversation secret), authentication (know you are talking to the right person) and integrity (be sure that you are reading exactly what the other guy sent). Here, we’ll just give a general overview of the problems that were exploited by the SLOTH authors, and what that tells us about our attitudes to cryptography in particular, and security in general. The SLOTH paper is fairly technical, and relies on quite a lot of cryptographic jargon, making it hard to penetrate if you aren’t a cryptographer already. In the words of the authors of the paper, SLOTH is “a not-so-subtle reference to laziness in the protocol design community with regard to removing legacy cryptographic constructions.” Indeed, the name is both an acronym, short for Security Losses from Obsolete and Truncated Transcript Hashes, and a metaphor. Like those three previous security problems, SLOTH is the result of modern cryptographic protocols continuing to use superannuated cryptographic algorithms, and needlessly being less trustworthy as a result. VUWACONA is short for Vulnerability With A Cool Name, our new acronym for bugs like LOGJAM, FREAK and Poodle.

The big “cryptographic cracking” story so far in 2016 is SLOTH, which is not only interesting and important, but also a VUWACONA, making it eye-catching as well.

Poodle crypto locker