RE: "PGP Encryption Proves Powerful"

2003-06-03 Thread Jill . Ramonsky
Actually, I _am_ the proud posessor of a Psion Series 5mx, and I have had PGP for EPOC installed on it for a few years now. It's not the original, obviously, but it claims to be a port to the EPOC operating system of PGP 2.6.3ia. The About page says "International version - not for use in the USA.

Re: "PGP Encryption Proves Powerful"

2003-06-03 Thread Ben Laurie
John Kelsey wrote: > At 01:22 PM 5/29/03 -0400, Ian Grigg wrote: > >> The following appears to be a bone fide case of a >> threat model in action against the PGP program. > > > ... > > Two comments: > > a. It sure seems like it would be a pain to enter a long passphrase on > one of these thin

Re: Maybe It's Snake Oil All the Way Down

2003-06-03 Thread Ian Grigg
A lot of the tools and blocks are too hard to understand. "Inaccessible" might be the proper term. This might apply to, for example, SSL, and more so to IPSec. These have a lower survival rate, simply because as developers look at them, their eyes glaze over and they move on. I heard one guy s

Re: Maybe It's Snake Oil All the Way Down

2003-06-03 Thread Amir Herzberg
Erik is right: there must be very strong motivation to consider using a cryptographic mechanism/protocol which is not `standard` (de-facto standards are Ok). When this motivation is supposedly improved security, the new (supposedly more secure) primitive should preferably be composed with a sup

Re: Maybe It's Snake Oil All the Way Down

2003-06-03 Thread Peter Gutmann
Ian Grigg <[EMAIL PROTECTED]> writes: >Also, a lot of cryptosystems are put together by committees. SSH was >originally put together by one guy. He did the lot. Allegedly, a fairly >grotty protocol with a number of weakneses, but it was there and up and >running. And SSH-2 is apparantly nice,

Re: Maybe It's Snake Oil All the Way Down

2003-06-03 Thread Eric Murray
On Mon, Jun 02, 2003 at 10:09:06AM -0400, Ian Grigg wrote: > A lot of the tools and blocks are too hard to > understand. "Inaccessible" might be the proper > term. This might apply to, for example, SSL, > and more so to IPSec. These have a lower survival > rate, simply because as developers look

Re: Maybe It's Snake Oil All the Way Down

2003-06-03 Thread bear
"Scott Guthery" <[EMAIL PROTECTED]> writes: > When I drill down on the many pontifications made by computer > security and cryptography experts all I find is given wisdom. Maybe > the reason that folks roll their own is because as far as they can see > that's what everyone does. Roll your own t

Re: Maybe It's Snake Oil All the Way Down

2003-06-03 Thread Ian Grigg
Eric Murray wrote: > > On Mon, Jun 02, 2003 at 10:09:06AM -0400, Ian Grigg wrote: > > A lot of the tools and blocks are too hard to > > understand. "Inaccessible" might be the proper > > term. This might apply to, for example, SSL, > > and more so to IPSec. These have a lower survival > > rate,

Re: Maybe It's Snake Oil All the Way Down

2003-06-03 Thread Eric Rescorla
Ian Grigg <[EMAIL PROTECTED]> writes: > Eric Murray wrote: > It may be that the SSL underlying code is > perfect. But that the application is weak > because the implementor didn't understand > how to drive it; in which case, if he can > roll his own, he may end up with a more > secure overall pac

Re: "PGP Encryption Proves Powerful"

2003-06-03 Thread Bill Stewart
At 11:38 AM 05/30/2003 -0700, John Young wrote: If the FBI cannot crack PGP that does not mean other agencies with greater prowess cannot. It is unlikely that the capability to crack PGP would be publicly revealed for that would close an invaluable source of information. . Still, it is impressi

RE: Maybe It's Snake Oil All the Way Down

2003-06-03 Thread Lucky Green
Ian Grigg wrote: > Also, a lot of cryptosystems are put together > by committees. SSH was originally put together > by one guy. He did the lot. Allegedly, a fairly > grotty protocol with a number of weakneses, but > it was there and up and running. And SSH-2 is > apparantly nice, elegant and ea