what is purpose of CMR?
This is a question which I am unclear on about PGP Inc's design goals in using the CMR method. Is the CMR field to allow the company to recover from the user forgetting his password? (recover his mail folder full of encrypted email). or Is the CMR field to allow the company to read the email in transit This seems like a fairly important distinction. Adam
At 12:54 AM 10/18/97 +0100, Adam Back wrote: This is a question which I am unclear on about PGP Inc's design goals in using the CMR method. Is the CMR field to allow the company to recover from the user forgetting his password? (recover his mail folder full of encrypted email). or Is the CMR field to allow the company to read the email in transit This seems like a fairly important distinction. It's not for surveillance. It's for recovering from disaster. I think it would be a good thing to send a PGP message over an encrypted link (TLS or other). Jon ----- Jon Callas jon@pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA)
Jon Callas <jon@pgp.com> writes:
At 12:54 AM 10/18/97 +0100, Adam Back wrote:
[what is CMR key for surveillance/ or disaster recovery]
It's not for surveillance. It's for recovering from disaster.
In that case recovery can be much more simply and securely achieved locally to the recipient. Escrow or use locally stored recovery information. The CMR key is not needed for this functionality.
I think it would be a good thing to send a PGP message over an encrypted link (TLS or other).
This is an independently good idea and would mitigate some of the possibilites of CMR functionality being used for purposes other than it's designers intended. However it is hard to do; and the keys have different security focus becuase it is hard to use user <-> user end to end TLS because of the store and forward nature of email. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`
participants (2)
-
Adam Back -
Jon Callas