Date: Sun, 30 Dec 2001 09:50:17 +0800 From: Raymond <[EMAIL PROTECTED]> Subject: Re: [LIB] Security
At 05:42 PM 29/12/2001 -0800, you wrote: >Date: Sun, 30 Dec 2001 01:36:17 +0000 >From: "Matthew Hanson" <[EMAIL PROTECTED]> >Subject: Re: [LIB] Security > >>Date: Sat, 29 Dec 2001 16:35:01 -0800 (PST) >>From: David Chien <[EMAIL PROTECTED]> > >>www.pgpi.com's PGP Disk will help keep your PC secured from outside > >Something that guy said that threw me was that PGP was an algorithm in itself. I >always thought that PGP was Philip Zimmerman's system of excanging keys... and that >he used RSA or some other established algorithm to do the actual encryption. My >memory is foggy on this. The only time I used PGPi, I think I recall having to >choose an algorithm from a drop-down box. IDEA data encryption, RSA for key management, MD5 for hashes. IDEA hasn't been publicly broken yet, I don't think RSA nor MD5 have been sufficiently comprimised to render the PGP system insecure either. IIRC key lengths are also long enough to keep data secure for a decade or 2 barring any major advances in cryptographic techniques (I'm going by what I read in 'Applied Cryptography' first edition here though, I've not read any more recent confirming texts on these algorithms so I could be wrong). >Another thing this guy told me was that DES has been broken. Well IIRC DES to NSA's public standard can now be broken by brute force anyway given a sufficiently resourced adversary. You could use triple-DES though and make it a lot harder ... > I asked if it's something that would a few super-computers to throw at, and he said >no. That is was a simple high-school hack of some kind. Like I said... I don't >follow this stuff very much... so DES could have patched (can that be done?) by this >point for all I know. *shrug* did he say DES had been broken or a specific DES implementation has been broken? Bear in mind, there are 2 parts to any piece of encryption software, the algorithm and the implementation. Often the implementation can be broken more easily than the algorithm itself (eg. if the implementation puts a constant header somewhere you can use a known plaintext attack for instance). Of coures, DES itself is getting old now anyway ... IIRC it was based on IBM's Lucifer cipher and supposed to expire in the 90's as a standard anyway (note DES stands for Data Encryption Standard which is pretty ironic I guess). >>I laugh as other poor IE/Outlook users keep getting hacked/viruses/exploited >>with my Netscape-based, secured Libretto. > >Can someone explain to me just why Mircosoft thought it would be such a great idea to >be able to set an option in Outlook(X?) that would allow email attachments to be >launched automatically when an email is opened!!!???? As I recall, some of the first >versions came set up that way by default. >Wasn't that what originally inspired the creator of the Love bug? Thats Microsoft for you ... remember, security is inversely proportional to convenience. Microsoft's OE just went too far for convenience. If you're paranoid about that, use Pine, good luck any executables getting run there!! - Raymond --- /~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\ | | "Does fuzzy logic tickle?" | | ___ | "My HDD has no reverse. How do I backup?" | | /__/ +-------------------------------------------| | / \ a y b o t | [EMAIL PROTECTED] | | | HTTP://www.raybot.net | | ICQ: 31756092 | Need help? Visit #Windows98 on DALNet! | \~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/ ************************************************************** http://libretto.basiclink.com - Libretto mailing list http://libretto.basiclink.com/archive - Archives http://www.picante.com/~gtaylor/portable/faq.html - FAQ -------TO UNSUBSCRIBE------- Reply to any of the list messages. The reply mail should be addressed to: [EMAIL PROTECTED] - Then replace any text on the message's subject line: cmd:unsubscribe --------TO UNSUBSCRIBE DIGEST------ Do above but with this on subject line: cmd:unsubscribe digest **************************************************************
