OWASP / wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
https://owasp.org/www-project-web-security-testing-guide/
Creative Commons Attribution Share Alike 4.0 International
7.37k stars 1.34k forks source link

Fixing typo in 09-04-Testing_for_Weak_Encryption #1150

Closed Bankde closed 4 months ago

Bankde commented 4 months ago

This PR covers issue #.

What did this PR accomplish?

fix the typo in content.

Thank you for your contribution!

kingthorin commented 4 months ago

https://dictionary.cambridge.org/dictionary/english/asymmetric

Bankde commented 4 months ago

Hi, the ECB is generally referred to "symmetric encryption", not asymmetric. Right now it's like saying RSA should not be used for symmetric encryption. It is not meaningful.

https://book.hacktricks.xyz/crypto-and-stego/electronic-code-book-ecb

(ECB) Electronic Code Book - symmetric encryption scheme

Edited a bit since it's possible to invent asymmetric ECB if you really want one.

rbsec commented 4 months ago

This PR fixes a mistake in the content (which is good), but also introduces a bit of a grammatical error, as "in a symmetric encryption" isn't really a complete sentence. And leads to the confusion about whether that should be "a symmetric" or "asymmetric".

How about we just cut the sentence short and say ...is not suggested for use. or generally should not be used. - because there's really very few cases where you should be using ECB at all, regardless of whether you're trying to do symmetric or some kind of weird asymmetric version of it?

Bankde commented 4 months ago

@rbsec thank you for the review. I agree with the better change.

kingthorin commented 4 months ago

Thank you both!

rbsec commented 4 months ago

There's definitely a crypto-related version of the four candles/fork handles sketch to be made out of this.