pem-dev
[Top] [All Lists]

Re: RIPEM details

1995-01-12 10:35:00
For the record...

PGP uses different encoding mechanisms for public keys, names and
certificates.  Also, as far as I understand, PGP's certification
mechanisms are pretty wild and crazy (more than RIPEM, that is :-) ).
For example, someone can be partially trusted by several certifiers
and these trusts must "add up" somehow for you to trust that person.
Also, I don't know whether PGP performs canonicalization of text and
other RFC 1421-required operations that RIPEM follows.

Yes, PGP's certificates aren't compatible with X.509.  This just means
that signatures on certificates won't work across systems.

PGP does canonicalize the text before processing.  In particular, it
does CR/LF canonicalization before making a signature.  I am fairly
confident that without much work a PGP signature and a PEM signature
could be cryptographically equivalent (if they aren't already -- I've
never checked).

As for the certification mechanisms, think of PGP as a user-specified
weighted transitivity principle.  Trust is only transitive through a
user-specified weight, and this weight can have a select set of
values.  PGP then adds up all the weights of all the signators on a
certificate to see if it reaches some user-specified threshold.

If PEM (I include RIPEM, TIS/PEM, et. al. in this) and PGP can agree
on an encryption mechanism (it looks like 3DES might be a possible
choice) then it is theoretically possible to make PEM and PGP message
compatible (although not necessarily certificate compatible).

I think this is probably a good long-term goal!

-derek

<Prev in Thread] Current Thread [Next in Thread>