October 1992 - cypherpunks-legacy

PGP vs RSA
by Jim McGrath 01 Nov '92

01 Nov '92

The other day someone mentioned that PGP uses a patented algorithm. If this is the case, then what is the difference between using it and the also patented RSA. From the little reading that I have done, it sounds like RSA is a better protocol from the point of view of authentication etc. etc. So, the question is, apart from the fact that PGP exists, and an RSA implementation is not yet available, (to the best of my limited knowledge) is there any reason why we shouldn't use it? Jim McGrath I'd rather have a bottle in front of me than a frontal lobotomy.

2 1

Why I Don't Use PGP...
by Hal 31 Oct '92

31 Oct '92

The best way to integrate PGP into other software is a tough question. There are so many different ways in which people read and send mail. A lot of people receive their mail on some other machine, often a multi-user machine. So, the first question is, should the mail be crypted there, or should it be crypted on your personal machine. The second choice is preferable from the security point of view, but that means that you need to download at least your PGP mail in order to decrypt it, and it means you have to compose your mail on your home machine before encrypting, uploading, and sending. (Phil Zimmermann had an idea for multi-user systems in which the RSA portion of the decryption, which involves your secret key, would be done on your personal machine, then the decrypted session key would be uploaded to the multi-user machine and the IDEA decryption done on the message itself. This way you only have to upload and download a couple hundred bytes regardless of the length of the message. This would require PGP to be integrated into a terminal program.) If you _do_ download your mail before reading it, you could get in the habit of downloading _all_ of your mail into a big file, then running a word processor or some more specialized program to read the messages, one at a time, and compose replies. Then, when you were done, you could upload and send the replies. If you worked in this mode, which probably few people do, you could integrate PGP by running it on the downloaded mail file before running your WP to read it. I have a Perl script which runs PGP on a file, finding the PGP messages in it, decrypting them, and replacing them _in_the_file_ with their decrypted versions. (Normally PGP outputs its decrypted contents to another file, which is a little inconvenient.) This can make PGP pretty transparent for decryption if you actually read your mail in this way. Another possibility is to use a WP or mail reading program which has a "filter" mode, one which lets you pass incoming or outgoing mail through some program, and replace the mail with the results of that program. I don't know which programs can do this. A lot of Unix programs can, like VI and EMACS, but I don't know about PC's or other home machines. PGP has a filter mode which is designed to be used with WP's which can do this. There have been a couple of messages on alt.security.pgp which have advice on using PGP with various Unix mail reading programs. Mark Riordan's soon-to-be-released RIPEM program (an alternative, incompatible, RSA public-key program) has some ideas in its manual on how to use its filter mode with Unix mail, which mostly apply to PGP as well. One other point: regarding a Mac port: There have been at least a couple of messages on alt.security.pgp over the past couple of months from people who have successfully compiled the PGP sources under Think C on the Mac. However, as a Unix/PC program, it ends up using a character window for I/O, which you type into just like you would on a PC. This is unacceptable for Macs, so nobody has released one of these. Still, compared to what Tim has to do, it would be an improvement. I think people should release their executables which work like this as an interim crutch version until the real Mac version is available. Hal 74076.1041(a)compuserve.com

2 1

Please remove me from the mailing list!
by Oren Mitz 31 Oct '92

31 Oct '92

Sorry, can't handle the numer of messages every day . Thankx and out. bye bye from O><M

1 0

re: Why I Don't Use PGP...
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 31 Oct '92

31 Oct '92

U> From: 74076.1041(a)CompuServe.COM (Hal) U> The best way to integrate PGP into other software is a U> tough U> question. There are so many different ways in which U> people read and send mail. U> don't know which programs can do this. A lot of Unix U> programs can, like VI and EMACS, but I don't know about U> PC's or other home machines. PGP has a filter mode which Not to brag, but my offline-reader (DOS version of a 'read news' program), as well as at least one other I know of, does a pretty good job of this. It handles the decrypted plaintext reasonably securely too. It does the decryption locally. (You have to manage your own keyrings externally, though of course keys embedded in messages are handled OK.) Solutions are out there. --- ReadMail * Origin: tomj(a)fidosw.fidonet.org / World Power Systems (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET: Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

2 1

Re: Why I Don't Use PGP
by George A. Gleason 31 Oct '92

31 Oct '92

Re. Ten Reasons Why I Don't Use PGP: This is exactly why we need a decent user interface. The ideal would be a public-domain wordprocessor, which could be fairly simple, with a menu option for encrypt/decrypt, signature, and so on. I've been working on something like this for my OTP, and would be glad to participate in a project to do it for PGP and other systems. -gg

1 0

re: Why I Don't Use PGP
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 30 Oct '92

30 Oct '92

U> From: tcmay(a)netcom.com (Timothy C. May) U> 10. Because I use a Mac and the Mac version is not out yet. I'll ask in the FidoNet PUBLIC_KEYS echo about Smackintoshes. U> 9. Because the Mac version may NEVER be out. ... prolly cuz noone can figger out how to make a lot of money from it! U> 4. Because I'm not yet convinced it is needed. Ayup. My feelings exackly. This is starting to sound just like my gun arguments... I don't need one on the street, but someday I may, no? U> 3. Because ideally our mailers should handle this in a U> push-button way Some do already... --- ReadMail * Origin: tomj(a)fidosw.fidonet.org / World Power Systems (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET: Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

1 0

remove from mailing list
by joeb＠arden.linet.org 30 Oct '92

30 Oct '92

Please unsubscribe me from your list. The mail load is just too much. I noticed that there are alot of people that subscribe then unsubscribe. You may want to consider mentioning in your ads the nature of this forum. I assumed it was a periodical newsletter of some kind. I would speculate from the frequency of subscribers that quickly un-subscribe that many are under the same assumption. This topic is very interesting but the mail is just too much. If you guys come out with a newsletter of some kind I'd be very interested. Thanks and sorry for the extra work. - JoeB

2 1

Copies of Crypt Handout and RSA FAQ
by tcmay＠netcom.com 30 Oct '92

30 Oct '92

Some people on this list picked up on my mention of the 60-page handout distributed at our first meeting (9-19-92) and have asked about getting copies. I've distributed all the copies I made before, but may be willing to make more. The problem is cost and time: each copy costs me about $2.00 and there are more than 100 people on this list. Any ideas? I also have a fresh copy of RSA's 52-page FAQ (which is also available by ftp, but many folks have had problems printing it). The same calculation applies. Whatever the solution, I will only make one "copy run," as I don't want to be a document distribution service on a continuing basis. Until a solution appears, PLEASE DO NOT SEND ME REQUESTS, MONEY, ETC. BTW, this applies to PGP 2.0 diskettes as well. I just mailed a diskette to someone who'd been unable to get the ftp'ed version. (And my diskette came from someone on this list, too...thanks!) I didn't ask for postage or diskette fees, but I clearly can't do this with dozens of folks. And yet it seems we ought to find a way to do this. One idea is to put our ideas into practice by having some kind of "escrow service" which holds deposited money (small amounts, given the items discussed here) and which can be used to buy small items, with payments handled electronically (ultimately settled with actual checks, of course). This could get out of hand, of course, so it's just an idea. Any comments? P.S. And don't forget to make your suggestions on the Crypto session at Hackers. I'll be issuing a status report soon. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

Why I Don't Use PGP
by tcmay＠netcom.com 30 Oct '92

30 Oct '92

Why I Don't Use PGP -- The Top 10 Reasons (from the David Lettercrypt Show) (...drum roll...) 10. Because I use a Mac and the Mac version is not out yet. 9. Because the Mac version may NEVER be out. 8. Because my old IBM PC won't read the 3.5" diskettes my Mac puts out. 7. Because downloading encrypted files with ZMODEM, writing them to DOS format (with Apple File Exchange), hauling out my Toshiba 1000SE laptop and firing it up, loading the 3.5" diskette, and then running PGP takes 5 minutes per message. 6. Because after doing all of the above, I usually get "This is not a PGP file," due to some obscure mistranslation somewhere along the way. 5. Because I barely have the time to read and respond to my ordinary e-mail, let alone decrypt mail, respond (on my DOS machine), and then reverse the above procedure. 4. Because I'm not yet convinced it is needed. It will be someday, but not for right now. (Getting PGP volume up is a great idea...it's the actual decryption that's a pain. Maybe we ought to send dummy messages.) 3. Because ideally our mailers should handle this in a push-button way (I know about the security flaws in having a nonlocal host machine, such as my NETCOM host, do the PGP procedure...I am hoping that someone will write something that transparently "reaches down" into my machine and triggers the computation locally on my machine--and I need a Mac version, of course. Probably an off-line Newsreader for the Mac, like Nuntius, is needed.) 2. Because I don't give out my PGP key (generated on my Toshiba) to all of those who have e-mailed me about it (especially in the wake of my postings about the Denning proposal). The last thing I want is more e-mail from people I've never met, sending me their encrypted secrets of the universe. (...and the Number One reason I don't use PGP?.....) 1. Because computers were supposed to make my life easier, and they haven't. Well, that's enough reasons. I guess I'm just lazy, or have higher priorities than to spend 5 frustrating minutes per mail message. Ironically, I'm not alone. I have heard that even Phil Zimmerman lets his PGP-encrypted messages pile up in his incoming mail, due to the hassles. As Eric Hughes has noted, it is precisely this pain that will cause improvements to be made. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

Subscribe
by edgar＠spectrx.Saigon.COM 30 Oct '92

30 Oct '92

I got this address off Extropians. Sorry if there's a separate "request" address I should be using, but I don't know what it is. Please add me to your mailing list. Please use one of these addresses: Internet: edgar(a)spectrx.saigon.com UUCP: szebra!spectrx!edgar The address in the network header may not work. I'm familiar with how PGP 2.0 works, including some bugs. I'm trying to start a low-cost public key registry, which can verify public keys independent of the network. Here is my signed 512-bit public key: -----Type bits/keyID Date User ID -----pub 512/4F0C47 1992/09/26 Edgar W. Swank <edgar(a)spectrx.saigon.com> -----sig! 67F70B 1992/10/14 Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.02 mQBNAirEvxwAAAECAMUkLHrx6JH45BMd4bxZDNQO3HrLmhZSvsHJzLH9+90BTbuX 3Kvo0pSLCh98m2Abu/LtoHDggJOKxRGee+5PDEcABRG0KUVkZ2FyIFcuIFN3YW5r IDxlZGdhckBzcGVjdHJ4LnNhaWdvbi5jb20+iQCVAgUQKtu1h+J13g7/Z/cLAQFg nAQAjRlKmmSvDMZUWKM2BQFmpqHBiaCg7OLKEFng9pZGx2qzYHCZOL+a9A0exN9P RAtV6bEm9+F8VoOEpVyF346XJwwE1e/13IETHFi7Jd9fbjsw8voQFqz69X2p8xoE LxYtqSlwfOQ3S7JOyyx4/p04fG/JZuRJicVaUIRlDKHJPJ0= =tsbS -----END PGP PUBLIC KEY BLOCK----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

1 0