Re: X.509 / PKI, PGP, and IBE Secure Email Technologies

2005-12-10 Thread Victor Duchovni
On Thu, Dec 08, 2005 at 05:10:20PM -0800, Ed Gerck wrote: PGP is public-key email without PKI. This is true for use in geodesic networks, but not true for inter-organization email, one ends up introducing gateway systems, that create an ad-hoc PKI of gateways that have exchanged keys and users

Re: X.509 / PKI, PGP, and IBE Secure Email Technologies

2005-12-10 Thread Anne Lynn Wheeler
Ed Gerck wrote: I believe that's what I wrote above. This rather old point (known to the X.509 authors, as one can read in their documents) is why X.509 simplifies what it provides to the least possible _to_automate_ and puts all the local and human-based security decisions in the CPS.

Re: X.509 / PKI, PGP, and IBE Secure Email Technologies

2005-12-10 Thread Anne Lynn Wheeler
Ed Gerck wrote: PGP is public-key email without PKI. So is IBE. And yet neither of them has all the identical, same basic components that PKI also needs. Now, when you look at the paper on email security at http://email-security.net/papers/pki-pgp-ibe.htm you see that the issue of what

Re: X.509 / PKI, PGP, and IBE Secure Email Technologies

2005-12-10 Thread Anne Lynn Wheeler
James A. Donald wrote: However, the main point of attack is phishing, when an outsider attempts to interpose himself, the man in the middle, into an existing relationship between two people that know and trust each other. in the public key model ... whether it involves pgp, pki, digital

Re: X.509 / PKI, PGP, and IBE Secure Email Technologies

2005-12-10 Thread Ed Gerck
Anne Lynn Wheeler wrote: usually when you are doing baseline ... you start with the simplest, evaluate that and then incrementally add complexity. I think that's where PKI got it wrong in several parts and not just the CPS. It started with the simplest (because it was meant to work for a

Re: X.509 / PKI, PGP, and IBE Secure Email Technologies

2005-12-10 Thread Bill Stewart
At 09:40 AM 12/8/2005, Aram Perez wrote: On Dec 7, 2005, at 10:24 PM, James A. Donald wrote: Software is cheaper than boats - the poorest man can afford the strongest encryption, but he cannot afford the strongest boat. If it is that cheap, then why are we having this discussion? Why isn't

secure links using classical (i.e., non-quantum) physics

2005-12-10 Thread Steven M. Bellovin
http://arxiv.org/abs/physics/0509136 Totally Secure Classical Communication Utilizing Johnson (-like) Noise and Kirchoff's Law Authors: Laszlo B. Kish Comments: 14 pages; Google search terms: +totally +secure +communication Subj-class: General Physics Journal-ref: Manuscript featured by Science,

[Clips] Engineer Outwits Fingerprint Recognition Devices with Play-Doh

2005-12-10 Thread R. A. Hettinga
Same story, different malleable substance... Cheers, RAH --- --- begin forwarded text Delivered-To: [EMAIL PROTECTED] Date: Sat, 10 Dec 2005 11:08:14 -0500 To: Philodox Clips List [EMAIL PROTECTED] From: R. A. Hettinga [EMAIL PROTECTED] Subject: [Clips] Engineer Outwits Fingerprint