🚀 go-pugleaf

From article <>, by 74076.1041@CompuServe.COM (Hal):
> -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: 2.01

Hey, what's "Version 2.01"? Was the patch released yet?
Why isn't the world notified? (:-)

Regards,
Uri.
------------
<Disclaimer>
-- 
Regards,
Uri.		uri@watson.ibm.com
------------
<Disclaimer>

In article <920929152106_74076.1041_DHJ67-1@CompuServe.COM> 74076.1041@CompuServe.COM (Hal) writes:
>I think people are coming down too hard on Terry Ritter, who
>is just trying to alert people to problems with using public
>keys without validation.  He is getting all these sarcastic
>comments just because people don't like to hear the things he
>is saying.

I'll agree with that. Terry seems to me to be saying,"It's a good system but
there are weaknesses.  What are you going to use it for?"

In the PGP Phil Z compares encrypted e-mail to the envelope we use for letters.
Well, you can steam letters open; put medicinal alcohol on them and make them
transparent; poke in a split stick, wind the letter round it, remove the letter
read it and put it back.  Should we give up using envelopes?

(I hope I didn't tell you something you didn't already know there)

Richard
[NULL signature]

 In <BvE5yD.14L@exnet.co.uk> s0rah@exnet.co.uk (R A Hollands) writes:

>Terry seems to me to be saying,"It's a good system but
>there are weaknesses.  What are you going to use it for?"

 Not quite, actually.  I was *trying* to say: "It's a good system,
 and should have almost *no* weaknesses, PROVIDED that it is *used
 correctly*.  I was attempting to describe incorrect usage, and
 show *why* that usage really was incorrect.

 I guess I would like to see public-key documentation put more
 emphasis on user responsibilities.  It seems unlikely that *any*
 system can deliver true secrecy *by itself*; each user is
 necessarily responsible for operating the system in ways which
 will secure the secrecy that the system can deliver.

 Individuals in the US (and probably most of the "free world") have
 very little experience with information security.  One of clippings
 in my files is a column from Insight for Dec. 10, 1990 (p. 28),
 during the buildup in the Saudi desert.  It seems that Iraqi
 radiomen picked up names of US servicemen, and then got Marine
 patrols "to bite on a phony message."  Obviously, proper military
 equipment, training, and execution could have prevented this (and
 probably quickly did).  But normal people in our society simply
 do not expect such attacks, and don't operate in ways to minimize
 those possibilities.  Until people understand the possible problems,
 they are vulnerable, *even if* they have a good cryptosystem.

 (Indeed, I would argue that the lack of understanding of information
 security by the general populace--some of whom must inevitably get
 into critical situations--constitutes a national security problem
 much larger than any use of cryptography by criminals.)


>In the PGP Phil Z compares encrypted e-mail to the envelope we use
>for letters.  Well, you can steam letters open; put medicinal alcohol
>on them and make them transparent; poke in a split stick, wind the
>letter round it, remove the letter read it and put it back.  Should
>we give up using envelopes?

 We should absolutely give up sending *serious* secrets in
 envelopes :-).

 But I guess you mean that the cryptosystem can be less than secure
 if we only use it for small secrets.  I never know how to respond
 to this:  We have to set up a secure link *before* we use it.  Can
 we know the extent of the secrecy we will need in the future?  Can
 we afford to squander secrecy up front simply because we are lazy
 and would prefer not to validate public keys?  I wouldn't think so,
 but I'm certainly willing to listen.

 ---
 Terry Ritter   ritter@cactus.org

In article <1992Oct4.075456.11026@cactus.org> ritter@cactus.org (Terry Ritter) writes:
>
> But I guess you mean that the cryptosystem can be less than secure
> if we only use it for small secrets.  I never know how to respond
> to this:  We have to set up a secure link *before* we use it.  Can
> we know the extent of the secrecy we will need in the future?  Can
> we afford to squander secrecy up front simply because we are lazy
> and would prefer not to validate public keys?  I wouldn't think so,
> but I'm certainly willing to listen.
>

(Just yell if "I really want to get out of this discussion" still applies)

If we expand "small secrets" so that our secrets are evaluated in terms of
the cost to us of their being compromised - big secrets, high cost - then
doesn't it make sense to spend only as much on secrecy as we think our
secret is worth?

Since "absolute" security is absolutely unattainable aren't we actually
obliged to do this (unless we're in it for amusement sake only)?

Isn't "good enough" good enough?  PGP seems good enough to me, but, then,
I've only got small secrets.  And a public key posted here is just a 
supply of envelopes.

Richard

 In <BvnqH7.32C@exnet.co.uk> s0rah@exnet.co.uk (R A Hollands) writes:

>> But I guess you mean that the cryptosystem can be less than secure
>> if we only use it for small secrets.  I never know how to respond
>> to this:  We have to set up a secure link *before* we use it.  Can
>> we know the extent of the secrecy we will need in the future?  Can
>> we afford to squander secrecy up front simply because we are lazy
>> and would prefer not to validate public keys?  I wouldn't think so,
>> but I'm certainly willing to listen.

>(Just yell if "I really want to get out of this discussion" still applies)

 It's not permanent, it's just that composing a serious response
 for each of many different postings seriously limits real life.
 I'm still catching up on the latter.


>If we expand "small secrets" so that our secrets are evaluated in terms of
>the cost to us of their being compromised - big secrets, high cost - then
>doesn't it make sense to spend only as much on secrecy as we think our
>secret is worth?

 OK, but exactly what is the operational "cost" of a spoofing
 process running on somebody else's computer?  What kind of
 secret costs less than sending "new key" messages to both ends?
 (I see no reason to imagine that this would not succeed if the
 ends never validated their keys originally.)

 Certainly, no such program can handle *all* situations, but those
 messages it could not handle could be detoured for human action.
 Then, once spoofing has been accepted by both ends, deciphering
 and re-enciphering should be automatic and invisible to the users.
 This is cheap, clean, white-collar intelligence; a real threat.


>Since "absolute" security is absolutely unattainable aren't we actually
>obliged to do this (unless we're in it for amusement sake only)?

 True, absolute security is a goal; not reality.  But it would
 seem rather strange to argue that this means that we don't need
 to worry about enforcing security (since we know it can never be
 "absolute").  It seems to me that we need to fix every hole we
 can find, but most especially the cheap and easy holes.


>Isn't "good enough" good enough?  PGP seems good enough to me, but, then,
>I've only got small secrets.  And a public key posted here is just a
>supply of envelopes.

 Again, PGP is *not* the problem.  The problem is *users* who do
 not validate their public keys.

 A public key posted here may or may not be spoofed.  If the key is
 not spoofed, then we save all the trouble of validating the key.
 But if the key *is* spoofed, then there is no secret at all.  There
 is *no* envelope; the subsequent conversation is *completely* open.

 Thus, the "good enough" aspect of non-validated keys mainly acts
 to enable the construction of a spoofing system.  Once the system
 is constructed, it can be applied virtually for free.  This does
 not mean that *everyone* could be attacked, but since we could not
 know who *would* be at risk, we all have to accept the possibility.
 When spoofing is applied, the "cost" of attacking a non-validated
 key is almost zero.

 Why would anyone bother using a cryptosystem if they will only
 use it in a way that can be completely negated almost at will?

 ---
 Terry Ritter   ritter@cactus.org

Well, now you've said it three times slowly and loudly I think I'm
begining to get the point!

How does this analysis sound to you?

   - The only person who can verify my key with reasonable certainty is
me.  (Leaving aside the real paranoiacs in the other thread talking
about PGP having been spoofed).

   - The other element in the system that needs verification is the
communications path between me and the net.

   - So, if I have access to more than one route I can test my local
mail system by sending a copy of my key from one of my mailboxes to
another and comparing.  (The userids on the different systems are
different so are spoofer doesn't know what I'm about).

   What can I tell you?

   - "My mail system is verified. Use it with confidence"?  This message
can be spoofed but to what end?  If the spoofer isn't substituting my
key then he hasn't gained anything and if she is then I know and she
gains nothing but a sex change.

   - "My mail system is compromised.  Do not talk to me."  We now have
the same security as the write-only file (called "NULL:" on dos
systems).  But I presume I can take measures - sue the network
administrator for negligence or something.

   If this works can I extend it to users with only one net link: you
send me your key (ASCII format) and I print it and post it to you?  Then
somebody steams the envelope open!!

   Any good?

Richard

[ "Hey baby, you should be in real life!" - Zaphod Beelblebrox I ]