--- title: "Snake-oil security claims on crypto security product" url: https://infosecurity.ch/20100719/snake-oil-security-claims-on-crypto-security-product/ date: 2010-07-19 author: Fabio Pietrosanti (naif) language: en tags: [business, encryption, management, marketing, policy, privacy, voicesecurity] --- # Snake-oil security claims on crypto security product Security market grow, more companies goes to the market, but how many of them are taking seriously what they do? You know, doing security technology mean that **you are personally responsible** for the protection of the user’s information. You must make them aware of what they need, exactly what your are doing and which kind of threat model your product protect. A typical problem of product’s security features is represented by the inability of the user to evaluate the security claims of the product itself. So there’s a lot companies doing a not-so-ethical marketing of security features, based on the facts that no user will be able to evaluate it. The previously explained situation reside in the security topic of **Snake Oil Encryption**, an evolution in the scientific cryptographic environment that let us today use best of breed information protection technologies without having to worry too much about backdoors or insecurities. **Let’s speak about Snake Oil Encryption** [Snake Oil Cryptography](http://en.wikipedia.org/wiki/Snake_oil_%28cryptography%29) : In [cryptography](http://en.wikipedia.org/wiki/Cryptography "Cryptography"), **snake oil** is a term used to describe commercial cryptographic methods and products which are considered bogus or fraudulent. Distinguishing secure cryptography from insecure cryptography can be difficult from the viewpoint of a user. Many cryptographers, such as [Bruce Schneier](http://en.wikipedia.org/wiki/Bruce_Schneier "Bruce Schneier") and [Phil Zimmermann](http://en.wikipedia.org/wiki/Phil_Zimmermann "Phil Zimmermann"), undertake to educate the public in how secure cryptography is done, as well as highlighting the misleading marketing of some cryptographic products. **The most referenced crypto security guru, Philip Zimmermann and Bruce Schneier, was the 1st to talk about Snake Oil Encryption:** **[Snake Oil](http://www.philzimmermann.com/EN/essays/SnakeOil.html) by Philip Zimmermann** **[Snake Oil](http://www.schneier.com/crypto-gram-9902.html#snakeoil) by Bruce Schneier** The [Michigan Telecommunications and Technology Law Review](http://www.mttlr.org/html/articles.html) also made a very good analysis related to the Security Features of Security Products, **[SNAKE-OIL SECURITY CLAIMS” THE SYSTEMATIC MISREPRESENTATION OF PRODUCT SECURITY](http://www.mttlr.org/volnine/michener.pdf) .** They explain about the nasty marketing tricks used to tweak users inability to evaluate the security features, including economic and legal responsibility implication. **Several snake oil security product companies does not explain and are not clear about the threat model to which the product apply.** Very famous is the sentence of [Russ Nelson](http://russnelson.com/bio.html): > *“Remember, crypto without a threat model is like cookies without milk. ….. Cryptography without a threat model is like motherhood without apple pie. Can’t say that enough times. More generally, security without a threat model is by definition going to fail.”* **So, how to spot snake oil security products?** Check a guideline of to spot Snake Oil Encryption Products: [Snake Oil Warning Signs, Encryption Software to Avoid](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html) by [Matt Curtin](http://web.interhack.com/company/people/cmcurtin) . You can see this very good [Cryptographic Snake Oil Examples](http://www.ratliff.net/blog/2009/05/27/cryptographic-snake-oil/) by Emility Ratliff (IBM Architect at Linux Security), that tried to make clear example on how to spot Cryptographic Snake Oil. Here represented the basic guideline from [Matt Curtin](http://web.interhack.com/company/people/cmcurtin) paper: - **Companies that claim [Trust Us, We Know What We’re Doing’](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION00051000000000000000)** - **Companies that invent new technology terms without even explaining the innovation, called [Technobabble](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION00052000000000000000)** - **Product that use non public protocols along with proprietary and [Secret Algorithms](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION00053000000000000000)** - **Company that pretend to have invented new type of cryptography or a [Revolutionary Breakthroughs](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION00054000000000000000)** - **Companies that present [Useless Certification and supposed Independent Evaluation without any security value](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION00055000000000000000)** - **Product that claim to be [Unbreakabl](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION00056000000000000000)e** - **Companies that [claim other products are insecure with fake and artificial evidence](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION00058000000000000000)** - **Companies that claim their system is [Military Grade](http://www.interhack.net/people/cmcurtin/snake-oil-faq.html#SECTION000511000000000000000), while everyone know that today cryptography in civil sector is driving the innovation** - **Product that have [Unsubstantiated bit claims](http://en.wikipedia.org/wiki/Snake_oil_%28cryptography%29) (like 16384 bit or 46080 bit encryption and authentication of sessions)** **By checking that points it’s possible to evaluate how serious an encryption technology or product is.** ****But all in all how to fix that unethical security approach?**** It’s very significative and it would be really useful for each kind of security product category to make some strongly and independent evaluation guideline (like [OSSTMM](http://www.isecom.org/) for Penetration testing) , to make this security evaluation process really in the hands of the user. It would be also very nice to have someone making analysis and evaluation of security product companies, publishing reports about Snake Oil signs.