Bill rote:
It is my position that algorithm preference is just that, a preference,
and the final desision of what algorithms to use should be the sole
decision of the owner of the document (ie the sender).
I must respectfully disagree but then I have gotten rather deep into
autoexecution of mobile code (anyone looked real close at the VBScript
capability of OUTLOOK98 beta 2 ?).
Agree that the decision of what to use should be the sender's, at the
same time, what to *receive* should be that of the recipient. Currently,
I have all 40 bit algorithms turned off in Netscape and that is *my*
decision.
Would suggest that there be three choices: accept always, accept with
warning & OK, never accept.
Now that presupposes that the sender does not know what algoritms the
recipient will accept but also expect that that information might be
contained in some future certificate (though having to revoke simply
to add CAST-128 seems a bit extreeme).
However am convinced that in the near future, simple blind opening of
E-Mail with concurrent identification will no longer be acceptable.
Warmly,
Padgett