Re: PGP for //c - IIe

[glyn@cs.UAlberta.CA (Reade Glyn Devin)]

In article <26mg4r$i8p@crl.crl.com>, dhealy@crl.com (Dan Healy) writes:
> On the subject of encryption, has anyone been using the encrypt feature on
> ShadowWrite?  I think it's called XOR encrypt?  Is this anything like
> public key encryption?

I haven't used it, but if it's XOR encryption, then it's fairly primitive.
To give you the idea, the "encryption" used with WordPerfect (not XOR, but
better), can be broken within about 60 sec.

PGP uses an algorithm that is comparable in strength to Triple-DES ... the
main difference is that DES is a symmetric encryption scheme (both the
sender and receiver must know the encryption key), and PGP is asymmetric
(everyone knows the encryption key to a given user, but only the user
knows the decryption key -- the two are different and the former cannot
be used to determine the latter).  IOW, the problem with DES is that
you somehow have to tell the recipient what the key is -- and if you
have not done so securely, then you have compromised your code.  With RSA
(the algorithm used by PGP), you can put your encryption key in your
.sig or let people finger you for it -- it doesn't matter since they
can only send you encrypted mail, not read encrypted mail that others
have sent to you.

XOR encryption is a symmetric algorithm that anyone with a respectable
computer can break.  Single-DES can be broken, but only with strong
computing power of the fashion held by NSA.  It is believed that
triple-DES and PGP are "safe" from being broken, at least for the next
couple of decades.  (It will be at least a couple of decades before
anyone has sufficient computing power to break them but brute-force
attack.)

Anyone particularily interested in this thread should read the FAQs
for alt.security.pgp -- this has drifted a bit far for csa2 ;)

--
	G. Devin Reade		glyn@cs.ualberta.ca