Re: public-key: the wrong model for email?

2004-09-17 Thread Adam Shostack
On Thu, Sep 16, 2004 at 06:12:48PM +0100, Ian Grigg wrote: | Adam Shostack wrote: | Given our failure to deploy PKC in any meaningful way*, I think that | systems like Voltage, and the new PGP Universal are great. | | I think the consensus from debate back last year on | this group when Voltage

Re: public-key: the wrong model for email?

2004-09-17 Thread Bill Stewart
At 10:19 PM 9/15/2004, Ed Gerck wrote: Yes, PKC provides a workable solution for key distribution... when you look at servers. For email, the PKC solution is not workable (hasn't been) and gives a false impression of security. For example, the sender has no way of knowing if the recipient's key is

Re: public-key: the wrong model for email?

2004-09-17 Thread Ed Gerck
Adam Shostack wrote: On Thu, Sep 16, 2004 at 12:05:57PM -0700, Ed Gerck wrote: | Adam Shostack wrote: | | I think the consensus from debate back last year on | this group when Voltage first surfaced was that it | didn't do anything that couldn't be done with PGP, | and added more risks to boot. |

Symantec to acquire @Stake

2004-09-17 Thread R. A. Hettinga
http://www.siliconvalley.com/mld/siliconvalley/9682511.htm?template=contentModules/printstory.jsp The San Jose Mercury News Posted on Thu, Sep. 16, 2004 Symantec to acquire digital security company CUPERTINO, Calif. (AP) - Symantec Corp. said Thursday it is acquiring digital security

Re: public-key: the wrong model for email?

2004-09-17 Thread Anne Lynn Wheeler
At 05:35 PM 9/16/2004, Adam Shostack wrote: Generate a key for [EMAIL PROTECTED] encrypt mail to Bob to that key. When Bob shows up, decrypt and send over ssl. note there is still the issue of knowing it is bob ... whether before the transmission or after the transmission and, in fact, the

Re: public-key: the wrong model for email?

2004-09-17 Thread lrk
On Thu, Sep 16, 2004 at 04:57:39PM -0700, Bill Stewart wrote: At 10:19 PM 9/15/2004, Ed Gerck wrote: Yes, PKC provides a workable solution for key distribution... when you look at servers. For email, the PKC solution is not workable (hasn't been) and gives a false impression of security. For

Re: public-key: the wrong model for email?

2004-09-17 Thread Ian Grigg
lrk wrote: Perhaps it is time to define an e-mail definition of crypto to keep the postman from reading the postcards. That should be easy enough to implement for the average user and provide some degree of privacy for their mail. Call it envelopes rather than crypto. Real security requires more

[Openswan dev] [Announce] Openswan 2.2.0 released

2004-09-17 Thread R. A. Hettinga
--- begin forwarded text Date: Fri, 17 Sep 2004 17:48:25 +0200 (MET DST) From: Paul Wouters [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [Openswan dev] [Announce] Openswan 2.2.0 released List-Id: Openswan developer mailinglist dev.openswan.org List-Archive:

Re: public-key: the wrong model for email?

2004-09-17 Thread Ed Gerck
Bill Stewart wrote: At 10:19 PM 9/15/2004, Ed Gerck wrote: Yes, PKC provides a workable solution for key distribution... when you look at servers. For email, the PKC solution is not workable (hasn't been) and gives a false impression of security. For example, the sender has no way of knowing if