Re: Is PGP broken?

2000-12-04 Thread John Kelsey
-BEGIN PGP SIGNED MESSAGE- At 05:52 PM 12/3/00 -0800, Bram Cohen wrote: ... If I recieve mail from a mailing list, it potentially might have info about both how to encrypt mail sent to the sender, and how to encrypt mail sent to the list - it really should be able to include both, and

Re: UK intelligence agencies want 7 years of records of all phone calls, emails and internet connections

2000-12-04 Thread Clive D.W. Feather
Caspar Bowden said: ..Britain's intelligence services are seeking powers to seize all records of telephone calls, emails and internet connections made by every person living in this country. A document circulated to Home Office officials and obtained by The Observer reveals that MI5, MI6 and

RE: Is PGP broken?

2000-12-04 Thread Ian Brown
A problem with including a public key with every plaintext message is that it isn't very discreet - actually looks kind of ugly in some peoples's email clients. You could use a separate PGP/MIME bodypart... Come to think of it, there are some tricky issues with regards to crypto on mailing

Re: UK intelligence agencies want 7 years of records of all phone calls, emailsand internet connections

2000-12-04 Thread Ken Brown
Yes, the headlines along the lines of "Secret plans to spy on phone calls" are misleading. I think we are all pretty sure that the various militarised security organisations do that already if they want. These proposals are meant to force companies to keep their logs for a long time, just in case

Re: UK intelligence agencies want 7 years of records of all phone calls, emails and internet connections

2000-12-04 Thread John Young
Clive Feather wrote: Calling this "NCIS carnivore" is misleading. It's concerned with transaction logs (who logged in when, web site logs, the sort of thing covered as "communications data" in RIP). Nothing to do with the contents of phone calls or email. I've been aware of these proposals for

Re: Is PGP broken?

2000-12-04 Thread Peter Gutmann
"Enzo Michelangeli" [EMAIL PROTECTED] writes: Apart from standards issues, one thing I'd like to see added to popular S/MIME agents is a mini-CA to issue self-signed certificates. This would allow people to use S/MIME as they use PGP (who relies on the WoT anyway?), breaking the dependency from

Re: Is PGP broken?

2000-12-04 Thread Arnold G. Reinhold
At 9:55 AM +0100 11/29/2000, PA Axel H Horns wrote: On 29 Nov 2000, at 7:07, Stephan Eisvogel wrote: Adam Back wrote: (And also without IDEA support for patent reasons even now that the RSA patent has expired.) Do you know when the IDEA patent will expire? I will hold a small party

RE: Is PGP broken?

2000-12-04 Thread Bram Cohen
On Mon, 4 Dec 2000, Ian Brown wrote: Come to think of it, there are some tricky issues with regards to crypto on mailing lists, it might make sense to have a X-crypto-originator [EMAIL PROTECTED] line in the headers to specify that the crypto information contained in that piece of mail

Re: /. Yahoo delivers encrypted email

2000-12-04 Thread solaar
Yahoo's new system works like this: Once a message is composed, it travels, unencrypted, to Yahoo, So feel no fear in sending anything you wouldn't mind being read before it's encrypted? I'm surprised AOL isn't offering this "security feature" as well ... I feel safer already :~) elyn

Re: migration paradigm (was: Is PGP broken?)

2000-12-04 Thread lcs Mixmaster Remailer
William Allen Simpson [EMAIL PROTECTED] writes: My requirements were (off the top of my head, there were more): 4) an agreed algorithm for generating private keys directly from the passphrase, rather than keeping a private key database. Moving folks from laptop to desktop has

Re: Is PGP broken?

2000-12-04 Thread lcs Mixmaster Remailer
It is often useful to include some information associated with a signature that is not in the hashed portion. There are several reasons for this. First, some information is not security critical and there is no reason to hash it. Second, some such information may be subject to change and

Re: Is PGP broken?

2000-12-04 Thread L. Sassaman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 4 Dec 2000, lcs Mixmaster Remailer wrote: Examples of the first case would be an identifier which indicates the signing key. In PGP this would be the key ID; in SMIME, CMS and other PKCS-7 derived formats it is the IssuerAndSerialNumber.

Re: /. Yahoo delivers encrypted email

2000-12-04 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], [EMAIL PROTECTED] writ es: Yahoo's new system works like this: Once a message is composed, it travels, unencrypted, to Yahoo, So feel no fear in sending anything you wouldn't mind being read before it's encrypted? I'm surprised AOL isn't offering this "security

Re: migration paradigm (was: Is PGP broken?)

2000-12-04 Thread Enzo Michelangeli
- Original Message - From: "lcs Mixmaster Remailer" [EMAIL PROTECTED] Sent: Tuesday, December 05, 2000 3:20 AM William Allen Simpson [EMAIL PROTECTED] writes: My requirements were (off the top of my head, there were more): 4) an agreed algorithm for generating private keys

Re: Is PGP broken?

2000-12-04 Thread Enzo Michelangeli
- Original Message - From: "Peter Gutmann" [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Tuesday, December 05, 2000 4:45 AM Subject: Re: Is PGP broken? "Enzo Michelangeli" [EMAIL PROTECTED] writes: Apart from standards issues, one thing I'd like