From: dlv@bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Sat, 15 Mar 1997 09:30:17 -0800 (PST)
To: cypherpunks@toad.com
Subject: Re: VSACM V2.0 Source Code Request (fwd)
In-Reply-To: <199703151544.JAA00486@einstein.ssz.com>
Message-ID: <4aBm4D52w165w@bwalk.dm.com>
MIME-Version: 1.0
Content-Type: text/plain


Jim Choate <ravage@EINSTEIN.ssz.com> writes:

> Forwarded message:
>
> > Subject: VSACM V2.0 Source Code Request
> > Date: Fri, 14 Mar 1997 23:31:49 -0600 (CST)
>
> > I would appreciate receiving a copy of the source code for your
> > encryption software, for the purpose of peer review.
>
> These sorts of requests are setting a bad precedence. All that should be
> needed for peer review is the algorithmic expression of the software, not
> its source code. The only issue that public review should consist of is the
> strength of the algorithm. Questions relating to specific implimentation
> questions should be done between vendor and client in private (caveat
> emptor!). What those questions should be should be open to public review as
> well. Class, not instance.
>
> Public review should be concerned with the characteristics of specific
> algorithms and not the honesty of the particular implementor.

I disagree. Remember when a widely available C implementation of the Blowfish
algorithm was found to have a bug that significantly weakened its security?
The bug was in the C implementation, not the algorithm itself.

By the way, I requested the source code from Mr.Ramos within minutes after
he made the offer on this mailing list and haven't heard back from him yet.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps