[Fwd: Dutch Transport Card Broken]

[Arshad Noor <arshad.noor@strongauth.com>]

When you think it isn't possible for people to make dumb
mistakes like this in the 21st century - especially when
so much is written and known about the principles of good
cryptography - along comes a story like this.  Wow!  $2B
down the drain.

I wonder if insurance companies that underwrite the bonds
of companies/agencies that fund these projects, factor in
the risk of "security through obscurity" on policies that
involve huge technology projects?

Arshad Noor
StrongAuth, Inc.

-------- Original Message --------
Subject: Dutch Transport Card Broken
Date: Thu, 24 Jan 2008 19:01:38 -0500
From: Perry E. Metzger <perry@piermont.com>
To: cryptography@metzdowd.com


Ed Felten has an interesting post on his blog about a Dutch smartcard
based transportation payment system that has been broken. Among other
foolishness, the designers used a custom cryptosystem and 48 bit keys.

http://www.freedom-to-tinker.com/?p=1250