Centrelink issues $500k unbreakable code for free

waste of money

Please explain to me why is the Australian government, in this case Centerlink of all agencies, is wasting tax payers money on developing secure authentication protocols for contactless smartcards- I mean is this really their job??? Why do they think they should be doing this??? Firstly, it is the role of private sector and IT industry to provide such solutions to meet the requirements of clients such as the government. It is inappropriate of government agencies such as Centerlink to think they can make up protocols, and then ask industry to implement in their products and adopt them as a standard so they can say it’s a COTS solution. Who do they think they are? They have no understanding of the commercial realities of vendors who provide these solutions. No mention of who is actually going to implement this protocol to provide the return on the investment made by the tax payer, and which they have decided to give away for free! Secondly, I would like to know what the actual requirements were, and the justification they have for approving the funding and developing of such technology. I don’t believe Centerlink has any reason what so ever to be developing smartcards with the level of security they are suggesting. Even the Defence Department does not have this type of technology, but at least they would have a justification. Even if there were really requirements for such a secure protocol for contactless smartcards, then there s a number of other far more superior and suitable agencies who have greater mandate and resources to research and develop this solution, namely CSIRO, DSTO, or one of the many CRCs and universities. ...just another example of agencies with not enough accountability overstepping the mark of responsibility

Is it PLAID or PLACID?

Sounds naive to me

This sounds dodgy to me. "Has withstood three years of trial" - big deal. Expose the algorithm worldwide and hope that someone *proves* its mathematically intractable to crack. What am I saying? I mean, hope that after many years of trying, no one finds an avenue of attack for the encryption.

Three years of relatively secret trials is close to meaningless, unless it involved top cryptographers.

As for the comment that it replaces existing systems that use PKI - in what way is that a step forward? As far as we know, PKI is not crackable by any technique known to any mathematician working outside the NSA, or without a working quantum computer. And there are several completely secure protocols (e.g. Kerberos, ssh) that depend on the public/private key duality of PKI.

And "PLACID[sic] is the only system that preserves the privacy of the cardholder from ID leakage. Other systems 'talk' from card to mainframe using easily captured personal information and unique identifiers in the ID-authentication process,". But that's the beauty of PKI.

PKI allows talking using easily captured information, but guarantees that's its completely useless to anyone without a million years of computing power up their sleeves to back-compute from. That's why Diffie and Hellman's work was such a breakthrough. So is Centrelink (renowned for its giants in the cryptographic community, I'm sure) saying that all current systems have broken designs?

As for the brilliance of using two cryptographic systems in quick succession - again, that's schoolboy stuff. Were any serious cryptographers were involved in this work?