Re: handling private keys

2005-06-29 Thread Milan P. Stanic
On Tue, Jun 28, 2005 at 10:51:40PM +0200, Sven Mueller wrote: Anyway, for the kind of use you would like to put your smartphone to, you also need some interface for the host application to contact the smartphone by and to transmit the data in both directions, some UI on the smartphone to

handling private keys

2005-06-28 Thread Radu Spineanu
Hello I working on a small project, and i have a problem related to keeping gpg private keys stored on usb drives secure when working with them. My problem is that in case the machine is compromised, if the usb with the key is mounted the attacker has access to it. Has anyone heard of an

Re: handling private keys

2005-06-28 Thread Edward Faulkner
On 6/28/05, Radu Spineanu [EMAIL PROTECTED] wrote: Has anyone heard of an implementation, or at least a whitepaper related to creating some kind of secure zone where i can keep these keys ? If you're using strong enough passwords, your keys would still be pretty safe. An attacker could try

Re: handling private keys

2005-06-28 Thread Radu Spineanu
Edward Faulkner wrote: As to your question, once someone roots your box all bets are off. If you're really paranoid about these keys, keep them on a dedicated machine that's extremely locked down. Or even a machine with no network at all, and move data back and forth on a usb drive. I was

Re: handling private keys

2005-06-28 Thread Sylvain Soliman
* Radu Spineanu [EMAIL PROTECTED]: I working on a small project, and i have a problem related to keeping gpg private keys stored on usb drives secure when working with them. My problem is that in case the machine is compromised, if the usb with the key is mounted the attacker has access to

Re: handling private keys

2005-06-28 Thread Christian Storch
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Radu Spineanu wrote: Hello I working on a small project, and i have a problem related to keeping gpg private keys stored on usb drives secure when working with them. My problem is that in case the machine is compromised, if the usb with the

Re: handling private keys

2005-06-28 Thread Jan Niehusmann
On Tue, Jun 28, 2005 at 05:38:16PM +0200, Christian Storch wrote: The only absolute solution would be a kind of intelligent usb drive which is accepting a file to decrypt or sign and offer the result. So somebody could use the key as long as you leave your usb drive in your machine, but not

Re: handling private keys

2005-06-28 Thread Ilkka Tuohela
ti, 2005-06-28 kello 17:38 +0200, Christian Storch kirjoitti: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Radu Spineanu wrote: Hello I working on a small project, and i have a problem related to keeping gpg private keys stored on usb drives secure when working with them. My

Re: handling private keys

2005-06-28 Thread Rick Moen
Quoting Radu Spineanu ([EMAIL PROTECTED]): Has anyone heard of an implementation, or at least a whitepaper related to creating some kind of secure zone where i can keep these keys ? Mine is called a PalmPilot with Keyring (3DES password store) installed, where I'm careful about what I install

Re: handling private keys

2005-06-28 Thread Edward Faulkner
On 6/28/05, Rick Moen [EMAIL PROTECTED] wrote: Mine is called a PalmPilot with Keyring (3DES password store) installed, where I'm careful about what I install on it. It strikes me that threat models are more easily isolated and dealth with on a PDA than on a networked computer, especially a

Re: handling private keys

2005-06-28 Thread Rick Moen
Quoting Edward Faulkner ([EMAIL PROTECTED]): I do the same thing with my passwords, but that doesn't quite answer the question. Radu wants a place to keep GPG keys safe - not just their passwords. Yes, good point. I don't have a good answer to Radu's situation other than don't use the

Re: handling private keys

2005-06-28 Thread Radu Spineanu
Edward Faulkner wrote: It would be pretty cool to use a PDA as a trusted device - it would download a document from the PC, ask you to verify it, then sign it and send it back. It's even better than a smart card, because you can use the PDA's display to verify that you're signing what you

Re: handling private keys

2005-06-28 Thread Radu Spineanu
Radu Spineanu wrote: In case anyone has some experience, is it hard to write such a symbian application ? Being more specific, porting gpg to symbian. I noticed an implementation of pgp: http://my-symbian.com/9210/applications/applications.php?faq=5fldAuto=336 Radu -- To UNSUBSCRIBE, email

Re: handling private keys

2005-06-28 Thread Sven Mueller
Radu Spineanu wrote on 28/06/2005 21:41: Radu Spineanu wrote: In case anyone has some experience, is it hard to write such a symbian application ? Being more specific, porting gpg to symbian. I noticed an implementation of pgp: