Adi Shamir’s three laws of security

Computerworld informs about the on-line availability of the lectures given by Rivest, Shamir and Adleman when they received the 2002 ACM Turing Award.

I want to highlight Shamir’s three laws of security:

• Absolutely secure systems do not exist
• To halve your vulnerability, you have to double your expenditure
• Cryptography is typically bypassed, not penetrated

The first two points show the importance of effective risk assessment while the third one emphasizes the fact that implementation flaws (opposed to algorithm design flaws) are usually the reason why systems using cryptography are subject to security breaches.