🚀 go-pugleaf

In article <1992Oct4.075456.11026@cactus.org> ritter@cactus.org (Terry Ritter) writes:
>
> But I guess you mean that the cryptosystem can be less than secure
> if we only use it for small secrets.  I never know how to respond
> to this:  We have to set up a secure link *before* we use it.  Can
> we know the extent of the secrecy we will need in the future?  Can
> we afford to squander secrecy up front simply because we are lazy
> and would prefer not to validate public keys?  I wouldn't think so,
> but I'm certainly willing to listen.
>

(Just yell if "I really want to get out of this discussion" still applies)

If we expand "small secrets" so that our secrets are evaluated in terms of
the cost to us of their being compromised - big secrets, high cost - then
doesn't it make sense to spend only as much on secrecy as we think our
secret is worth?

Since "absolute" security is absolutely unattainable aren't we actually
obliged to do this (unless we're in it for amusement sake only)?

Isn't "good enough" good enough?  PGP seems good enough to me, but, then,
I've only got small secrets.  And a public key posted here is just a 
supply of envelopes.

Richard