No, Armor doesn't effect the
security of PGP itself, but it does affect how OP products will or
can be used in the "real world" and therefore affects the "level of
security provided by" the PGP system. (if noone used PGP, PGP is still
secure, but the system is not because it isn't used).
Jeremey, you are trying to redefine the meaning of "security of a
system". I have never read any security literature which says, for
example, "DES is more secure than IDEA because it is more widely used."
Even accepting your redefinition, making armour a MUST increases the
effort needed to implement an OP-compatible system, so will reduce the
use of the standard - thus reducing its 'security'.
It is reasonably easy to go
get a new version of PGP which doesn't use RSA or IDEA, or doesn't
default to them. You don't have to change the way you "do things" to
switch to ElGamal and CAST. MIME is different, because it is external
to PGP.
And, as Dave Crocker has had to say over and over again, MIME is
becoming very widely used in mailers. The vast majority of people don't
even need to go out and get a new mailer to take advantage of it.
ASCII armor 1) already exists, 2) is widely used, and 3) is
quite trivial to implement
MIME 1) already exists, 2) is far more widely used than Armor, and 3)
won't need to be implemented by an OP-MIME system as the mailer will do
the work for you.
My point is that the capacity for
7-bit encoding is critical to PGP, and all OP-compliant products
should provide it regardless of what other 7-bit transport schemes
are supported.
Taking Jon's point: is the ability to do armour critical to an OP
implementation on a smartcard, used for example to authenticate a user
at login?
I don't have
LDAP in my mail reader. Neither does anyone else, with the exception
of Netscape and Micro$oft users.
Totally irrelevant to the argument.
Regards,
Ian.