[Top] [All Lists]

Re: The case against redundancy and isolation

1997-11-23 15:20:09

Ian Brown writes:
No, Armor doesn't effect the
security of PGP itself, but it does affect how OP products will or
can be used in the "real world" and therefore affects the "level of
security provided by" the PGP system. (if noone used PGP, PGP is still
secure, but the system is not because it isn't used).
Jeremey, you are trying to redefine the meaning of "security of a
system". I have never read any security literature which says, for
example, "DES is more secure than IDEA because it is more widely

Certainly not, I do not mean that PGP is "more secure" because it has
ASCII armoring capability (I thought I made this clear in that

What I mean is that a communications security system benefits from
wide deployment and use. Re-designing the system in ways that render
previous versions incompatible does not promote security. If there
is a compelling reason to change it (for instance if past versions
had protocol flaws, etc) then so be it, but I see no such reason here.
All I see is 'standardization'. One can provide countless examples
of standardization gone haywire (S/MIME, ASN.1, X.509, SET, etc.) and 
it does not always serve the end goal.

I absolutely agree that support for MIME is important, MIME is a
standard that is widely used. My argument is simply that ASCII armor
is not a transport issue, rather it is an important functionality of
PGP itself.

Taking Jon's point: is the ability to do armour critical to an OP
implementation on a smartcard, used for example to authenticate a user
at login?

Probably not, I can't see a case where it would be used. This is a 
good point, and makes a strong case for making ASCII armor a SHOULD 
and not a MUST. I wonder how feasible 100% compliance with OP is on 
a smartcard at all, with or without ASCII armor. Unfortunately, I 
think ASCII armor should be a MUST in almost every other case. Hrm.

- -- 
Jeremey Barrett                                BlueMoney Software Corp.
Crypto, Ecash, Commerce Systems     
PGP key fingerprint =  3B 42 1E D4 4B 17 0D 80  DC 59 6F 59 04 C3 83 64

Version: 2.6.2
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface