Crypto is Not Broken
By Patrick Ball On 14 February 2012, the New York Times reported that a Swiss team had found a weakness in a key algorithm used to make secure connections online. We were worried because the algorithm (called RSA) is also a central part of Martus , our self-encrypting database that backs itself up to a network of servers. The bottom line: We've consulted with cryptographers and studied the Martus code, and we do not believe that there is a weakness affecting Martus users. The flaw turns out to be related to a design error in the implementation of RSA in specific "embedded" devices, specifically firewalls and routers. It's not a general problem with RSA, and there's no current risk to Martus users. The way this flaw emerged has motivated us to review Martus's security model, and we are pleased with how well it has stood up. I've organized the detailed discussion as a series of questions. What exactly is the problem? How did this happen? Does it affect Ma...