Re: ** Anyone cracked CryptoSMS yet ? **

° Shanghai Lil ° wrote:
> A year or so ago there was much discussion about
> CryptoSMS with some self-proclaimed experts claiming
> it would be trivially easy to crack.
> 
> Has anyone cracked it yet?
> 
> 
> 
> 
A non biased account of CryptoSMS would look like this.

This does not imply any sort of meaningful security statement at all - 
It has not been cracked by anyone at sci.crypt.  And repeat; This does 
not imply any sort of meaningful security statement at all.  If you 
think it does then consider this -

The resources that an individual sci.crypter could bring to the job - 
very limited time, very limited budget and very limited computing power. 
  Compare this to a TLA, Large time with numbers of people working in 
consultation, large budget, massive computing power.

But there were (are?) deficiencies in the implementations of some 
elements of the software, such as not salting the password list combined 
with a possibly inadequate hash function MD5 (and IIRC there were also 
no multiple iterations of the hash function to generate the key - I 
could be wrong about that).

A competent security person would have avoided these problems and not 
used a damaged hash function in a new product.

So, if you would trust your secrets to a programmer who makes simple 
mistakes and thinks that beating a guy with a PC and a few spare hours 
is enough to claim his software is "unbreakable" then go ahead.

There is not much more to be said for that product.