🚀 go-pugleaf

In article <1991May24.051858.21459@ux1.cso.uiuc.edu>, phil@ux1.cso.uiuc.edu (Phil Howard KA9WGN) writes:
} smb@ulysses.att.com (Steven Bellovin) writes:
} 
} >The procedures are discussed in RFC1114; I commend that to those
} >interested in RSADSI's role.  Briefly, you will generate your own
} >public/private key pair.  That's mandatory -- otherwise, whoever issued
} .....
} >The normal mode of operation, then, would be for me to go to the AT&T
} >PEM office.  They'd generate a random public/private key pair for me.
} 
} Woooh!!!  Now AT&T can read all my traffic.  No thank you.
} 
} I will generate my own key, and no one gets my private component.  NO ONE!
} 
} >You cannot legally ``use your own unregistered key'' within the US;
} >to do so would be to infringe their patent.
} 
} Then what is the precedure for me to register my key (and it is only the
} private component that they get).  AT&T is NOT my long distance carrier.

Calm down.  You totally misread my posting.  That whole section of the
article was written in the first person.  I said that *I* would go to
the AT&T PEM office.  *I*, as an AT&T employee, would go.  You would go
to the university PEM office, or -- if you wished -- generate your own
key, get the application form notarized, and mail it to RSADSI yourself
(with a check, of course).

Incidentally, how are you going to use this key of yours?  On a
university machine?  Do you trust the system administrators there not
to bug the system?  Or to run things sufficiently securely that no one
else can hack the mail system?  Please control your paranoia, or at
least apply it uniformly....


		--Steve Bellovin