Internetworkers: http://www.ibiblio.org/internetworkers/

[Simon Spero <ses AT unc.edu>]

The most useful test to decide  whether your security system is secure 
"enough" is:
	Is the value of this information to my most capable potential enemy 
less than the cost to them of breaking the weakest part of my system?

The most useful test for deciding whether to increase the security of 
your system is:
	is  the value of a particular increase greater than the cost of making 
that increase?


A good example are the One Time Pads mentioned by Alan earlier.   One 
time pads when used correctly are absolutely unbreakable even in 
theory; however the cost of key management is mind boggling.   The key 
is the same length as the data;   Two copies of this enormous key must 
be generated absolutely randomly, with no leakage.  Every time a byte 
of key is used, it must be absolutely destroyed before the message is 
sent.  If one key is possibly compromised, you have to start over from 
scratch.  And if the cypher clerk is bribed, blackmailed, you're hosed 
anyway  (or even if they're just  lazy or incompetent-  that's how we 
know that Hiss and the Rosenbergs really were guilty).

Nevertheless, OTPS are still sometimes used; for low volume messages, 
which have to remain secret forever, and whose value to an enemy is 
overwhelming.

In the end, there's no way you can be absolutely certain of anythin. 
The NKVD could have implanted devices in your brain to make you think 
that this is the 21st century, and are trying to guide your illusions 
to make you reveal where the King of France is hiding the last breeding 
pair of unicorns.  Or not. Whatever.  Incidentally, where are those 
unicorns?