🚀 go-pugleaf

In article <1992Nov15.135015.19748@cubetech.com> andrew@cubetech.com writes:

>I just use ForYourEyesOnly that came as a 2.0 Demo app...  It's a
>NeXTSTEP app, you can insert files (but not directories, sigh) and use
>different fonts like NeXTmail, you can mail the ciphertext from the
>services menu, and...... it's legal to use in the US (whereas PGP
>(Pretty Good Privacy) is very ILLEGAL in the US).

If FEE is legal to use in the US, then why did it mysteriously
disappear from 3.0?  Is NeXT afraid of a legal challange from RSA?
I've been very curious about this since the early 3.0 announcements
made a really big deal about this capability.

Also, while you may trust ForYourEyesOnly to not have any trap doors
in it, I don't.  Will NeXT tell you how it works?  Will you believe
them?  For example, the "Secure" application that's on the Educational
Software Sampler CDROM looks rather cool.  Its description claims:

	Description:

	Secure provides private single key encryption to user files.
	It can be used either as a standalone or Services menu
	application.

It in fact does this.  But if you are the paranoid type (and it pays
to be if you're talking cryptography) and you "strings" your way
through the application, you find that is uses the UNIX 'crypt'
command!  While crypt makes your file unreadable to the naked eye, it
certainly has no real degree of security that I'd want to depend on;
certainly not compared to DES, which is what I expected to find.
Search "archie" for cbw, the Crypt-Breakers Workbench.

While I certainly applaud NeXT for the really neat application
interface, the business end of this app falls way short of what you'd
want to depend on.  I want to know what I'm getting and what I'm
depending on.  I really hope that a program like "Secure" becomes
available which uses real cryptography.

The principles behind RSA are pretty well known; the source code to
PGP is also available.  I would be a higher degree of trust in this
software rather then a "black box" with unknown properties.

If you don't believe that you can use PGP legally, perhaps you should
wait for the RIPEM package to become avialable, which is distributed
with the RSAREF software from RSA.  I believe that you will be able to
use this software for non-commercial purposes with RSA's blessing.
RIPEM messages look somewhat like PEM, though it doesn't use
certificates, just "bare" public/private keys.

louie