ViaCrypt PGP and source code
I am sure that businesses will buy ViaCrypt PGP, even for $100. PGP has proven itself to be a useful and safe encryption package, and also can do digital signature, a feature not seen in similarly priced PC security packages. I think to not release the source code with ViaCrypt PGP is a serious mistake. First, I cannot see how releasing the RSA source can be harmful to ViaCrypt. People can freely examine PD PGP, I can't see how any trade secrets are going to be revealed by showing the RSA source. Perhaps it is slightly faster, but information theoretic limits show that RSA quickly becomes lengthy to encrypt, and I doubt PKP nor ViaCrypt have made any significant progress towards making it faster compared with PD PGP. I had to laugh when people suggested the "Clipper-Like" review. Why is it good for ViaCrypt, but not good for the government? Let's face it...if ViaCrypt is serious about security, they will release all source code for examination, and will digitally sign all programs and have those signatures tracable to a key on a ViaCrypt owned dial-up BBS. I understand that there is a contractual problem with releasing the RSA source. Perhaps the contract should be re-negotiated. I will bet ViaCrypt PGP will rapidly become a best-seller if implemented properly. There is plenty of money to be made if everything is kept on the cryptographic "up and up." -Thomas
I understand that there is a contractual problem with releasing the RSA source. Perhaps the contract should be re-negotiated.
You don't seem to understand that RSA has a monopoly. You think they are going to bend over backwards for ViaCrypt PGP when they are pulling in millions in royalties from companies like Lotus?
I will bet ViaCrypt PGP will rapidly become a best-seller if implemented properly. There is plenty of money to be made if everything is kept on the cryptographic "up and up."
"Nobody ever went broke underestimating the intelligence of the American public." Consider how unaware most people are today. They're not going to care if they can audit the code; most people don't have the skills anyway. If AT&T or the government says something is secure, they will be believed by most people. Certain large organizations (like banks) may have the clout (financial clout, since that's what counts) to do their own code audit. But Cypherpunks just aren't big enough fish. There's plenty of money to be made if you aren't 'on the cryptographic "up and up"'. If you don't want to buy ViaCrypt PGP because you can't get sources, RSA isn't going to cry over those lost profits. Their monopoly insures that they can get their money from more compliant customers. Cynically yours, Marc
participants (2)
-
Marc Horowitz -
technopagan priest