Re: FW: CISCO PIX Vulnerability

["Perry E. Metzger" <perry () piermont com>]

Rick Smith writes:
> Adam Shostack's characterization of DES based products as "stupid" is
> important to examine, since DES is a mandatory part of all IPSEC
> implementations, and is currently the strongest product that some vendors
> can export.

You should remember that we made DES mandatory only for
interoperability reasons, and that the decision was made years ago. If 
we were doing it again today, I suspect that we would have made 3DES
mandatory instead.

> On the other hand, there are NO reports of a criminal or
> competitor having ever mounted a brute force cracking attack on a
> commercial enterprise and caused it real damage.

It is likely that you wouldn't hear about it if it happened.

> Security systems WILL fail regardless of how long the key is.

This I agree with.

.pm