A couple of comments on the cryptophone idea. First, there has seemed to be general agreement in our earlier discussions of this concept that the hard part is compressing the voice to the point where it can go over commonly-available modems. The government-standard CELP algorithm is too slow for general-purpose home computers. You need an algorithm that can operate in real time and compress intelligibly down to about 13K bits per second. It has to be either able to compress and decompress simultaneously or else you need some switching logic to decide which person is talking and which is listening at each moment, with both sides reversing roles in synchrony. Second, Diffie-Hellman key exchange will probably take about as long as an RSA decryption with similar modulus sizes. So speed would not seem to be a reason to choose DH over RSA for key exchange. If PGP is slow on your machine, DH will be, too. Hal Finney hfinney@shell.portal.com