5

Well, in this case, it is interesting to note one fact about the one-time pad. The key and the ciphertext are interchangable and indistinguishable. So rather then thinking about it as encryption, it is better to think of it as spliting in two. If the prosecution finds both pieces and can tie them to you, then they have a good evidence against you. Both parts ...


5

As the question mentions, and as the answer by leaustinwile explains in some detail, it is impossible to prove by cryptanalysis that a given decoding of a communication encrypted via a one-time-pad (OTP or pad) is correct. That does not mean that there is no way to prove such a decryption accurate to the satisfaction of a court of law. If the storage or ...


4

You're completely misreading the goals and purpose of the Export Controls Office - Overview. They regulate the transfer of US regulated information and technology, commodities, and software in the interest of national security and economic growth. Transfer and export are not the same as the use of technology that personal devices contain. The simplest ...


2

This is a very difficult matter, as it touches different parts of laws. IANAL, but I have been trained on several parts of labour law so I can point out some aspects. What can you do with the computer at work? If not declared by some agreement otherwise, a computer at work can only be used for work purposes. Your employer supplies you with tools (in this ...


2

It is Illegal Specifically, it is in breach of s7 of the TELECOMMUNICATIONS (INTERCEPTION AND ACCESS) ACT 1979: (1) A person shall not: (a) intercept; (b) authorize, suffer or permit another person to intercept; or (c) do any act or thing that will enable him or her or another person to intercept; a communication passing over a ...


2

This might be an unnecessary subtle point, but the goal of the GDPR isn't to protect personal data as some abstract concept – it regulates how personal data can be processed. For an organisation's compliance obligations, it matters for what purposes they collect and process personal data. You can't shove sensitive personal data on an unsuspecting recipient ...


1

Password fields are the least of your worries, actually. You shouldn't be storing passwords anyway, and the type of processing you should be doing on them (salt & hashing) is not covered under the GDPR. But your more general problem is indeed a real concern. However, the impact here is limited. Such a "general" field wouldn't be subject to specific ...


1

Yes You are confusing personal data with data that can identify a person Any data that is connected to a person is personal data: my friends list on Facebook, the record of the tweets I’ve viewed on Twitter, my recently watched video list on YouTube, and, yes, my password on any given website. None of that data on its own may be able to identify me but if ...


1

That's an interesting question. Because of the way OTPs work, you can supply an carefully selected arbitrary key to get any output you desire. See below for explanation. XOR is a commutative algorithm. Meaning that: Now if you supply a K(2) to the same CT you will now get something like: Meaning that because the selected key directly influences the ...


Only top voted, non community-wiki answers of a minimum length are eligible