Niels Ferguson > Quotes

“A friend of ours encountered this problem with his home-built computer long ago. He wrote a BIOS that used a magic value in a particular memory location to determine whether a reset was a cold reboot or a warm reboot. After a while the machine refused to boot after power-up because the memory had learned the magic value, and the boot process therefore treated every reset as a warm reboot. As this did not initialize the proper variables, the boot process failed.

The solution in his case was to swap some memory chips around, scrambling the magic value that the SRAM had learned. For us, it was a lesson to remember: memory retains more data than you think.”
― Niels Ferguson, Cryptography Engineering: Design Principles and Practical Applications

“Cryptography by itself is fairly useless. It has to be part of a much larger system.”
― Niels Ferguson, Cryptography Engineering

“Cryptography takes on the role of the lock: it has to distinguish between “good” access and “bad” access. This is much more difficult than just keeping everybody out.”
― Niels Ferguson, Cryptography Engineering

“Some saw cryptography as a great technological equalizer, a mathematical tool that would put the lowliest privacy-seeking individual on the same footing as the greatest national intelligence agencies.”
― Niels Ferguson, Cryptography Engineering

“A lock by itself is a singularly useless thing. It needs to be part of a much larger system. This larger system can be a door on a building, a chain, a safe, or something else.”
― Niels Ferguson, Cryptography Engineering

“The function of cryptographic protocols is to minimize the amount of trust required.”
― Niels Ferguson, Cryptography Engineering: Design Principles and Practical Applications

“Cryptography and security engineers need to know more than how current cryptographic protocols work; they need to know how to use cryptography.”
― Niels Ferguson, Cryptography Engineering

“Even though cryptography is only a small part of the security system, it is a very critical part. Cryptography is the part that has to provide access to some people but not to others. This is very tricky.”
― Niels Ferguson, Cryptography Engineering

“Complexity is the main enemy of security.”
― Niels Ferguson

“It is all too easy to spend hours arguing over the exact key length of cryptographic systems, but fail to notice or fix buffer overflow vulnerabilities in a Web application.”
― Niels Ferguson, Cryptography Engineering