How to Save PGP 235
Tomcat666 sends in: "The Register got some excerpts from an interview with Phil Zimmerman. He talks about how it might be possible to save PGP (Network Associates couldn't sell it, and will stop its development), OpenPGP and the future (industry-backed OpenPGP?)." A follow-up to our story yesterday about Network Associates mothballing PGP.
Re:Why not... (Score:2, Informative)
The source and encryption methodology betray nothing about how to decrypt a message. That is why PGP is pretty good. Also, is anyone really going to run a company that seems so inable to make money? As least people should have source to play with if they company is going under.
Sorta Phil's fault (Score:3, Informative)
If he would have put it under the GPL from the beginning we would not be seeing this. He would be like the Linus of crypto, but he was so determined to controll the things he shouldn't be controlling that he lost controll over the things he should be.
GUI Interface (Score:3, Informative)
But, the problem is you still must maintain your GnuPG bits manually on the command line. That was the beauty of NA's program. It had a slick GUI. Of course, in the end it didn't take me very long to pick up how to use gpg via the command line, but for the general populace it's still a barrier.
Re:Sorta Phil's fault (Score:2, Informative)
The PGP algorithm was not Phil Zimmerman's to sell. He basically made a freeware version of a popular commercial program, using their proprietary algorithm, and spread it all over the internet. He did this because believed that people should be able to avoid government surveillance on the internet. Whether or not you agree with him (I do), "encryption for the masses" is now a reality.
I would be willing to guess that Phil was more afraid of government agencies like the CIA, KGB, and FBI, than of Microsoft and Cisco. It is only slashdot readers who can't understand the difference between a corporation, which can take away your money or your job, and a government, which can take away your life or your freedom. Having to pay $1 extra on a DVD is not oppression. It may be unfair. It may be something you should write to your congressman about. But it is not opression. Oppresssion is being shot because you supported the wrong political candidate, like in the U.S.S.R. under Stalin.
GPGME - GPG Made Easy (Score:4, Informative)
GPGME [gnupg.org] is a project to do this. From the website: "It provides a High-Level Crypto API for encryption, decryption, signing, signature verification and key management."
It's a work in progress. It's useable, but of course, there is the standard disclaimer. Compiles fine on most Linux distributions. It needed a small amount of help to compile on Mac OS X. Not sure about any other OSes.
Re:Sorry, I don't believe in paying for software. (Score:3, Informative)
To see what RMS actually thinks about this subject see http://www.gnu.org/philosophy/selling.html
From that page:
Then again, when has an AC let reality interfere with the contents of his posts?
-Peter
Re:GPG, OpenPGP, and what needs saving (Score:4, Informative)
This has been asked many, many times of the GPG developers, and they always have a very sound, technically reasonable explanation: Making a shared or static library for the GPG code would be a security risk.
Once you have the code linked in (statically or dynamically) you can do Bad Things to the GPG code. Manipulate static variables, change environment settings, corrupt memory, all in an attempt to compromise security.
This makes integration a bit more difficult, but there are still a number of wrapper libraries that provide similar functionality using fork() and exec() with the command line.
Personally I prefer a bit more integration effort with more security than vice versa.
Re:GPGME - GPG Made Easy (Score:3, Informative)
No, but you can use ISO C to make system calls (ported like everything else in the dual *nix/win/mac universes) that can communicate with the GPG process.
Really, this isnt that big of a deal. It's a slight inconvienance, but you still end up with a very portable library that can be used to interface with GPG in a programmable manner.
Re:Why not... (Score:4, Informative)
GPG is available, and the Germans are improving it (Score:5, Informative)
It's true that currently GPG's user interface is terrible for beginning users if they have to use it directly. So, clearly, you want to use programs that embed GPG (like Evolution). Also, note that the German government is funding further development of GPG [gnupg.de]. They specifically say that their funding will be used to make GPG more usable by less experienced users, including porting the software to other operating systems, developing graphical user interfaces (GUI) and writing a handbook.
Thus, this sounds like a short-term problem at worst.
Re:Sorta Phil's fault (Score:3, Informative)
No he did not. Phil did not have rights to use the RSA algorithm. But the code, the message formats, everything that was all Phil and Phil alone.
Drove the rest of us working on secure email up the wall. Phil had a point about the PEM certification hierarchy nonsense. But he could have reused the PEM message formats instead of rolling his own.
The version of PGP in use today is largely the MIT version set up by Jeff Schiller and Hal Abelson and coded by Derek Atkinson arround RSAREF. That version has always been GPL as far as I know, with the major proviso that it linked to RSAREF which was encumbered big time but had no choice 'cos of the patent.
Re:Please do correct me if I'm wrong, but (Score:4, Informative)
You don't have to be a corporation to sign keys. In fact there is a certificate signer distributed with every copy of Microsoft Office and Windows XP. Code to create X.509 certs is available as freeware in many open source distributions.
If you try to do this with any S/MIME client that I know of, it will claim that the certificate is untrustworthy because Friendly Trusted Company, Inc hasn't signed for it.
You can select the certificate and say 'trust this certificate' explicitly in all the popular implementations.
If you don't like the way the S/MIME cert handling is done it is easy enough to do it any way you choose.
Another scheme would be to set up an XKMS interface to a PGP web of trust and then drop an XKMS client into the CAPI or cryptoAPI layer of your favorite email client. Then you can configure any trust semantics you like in your Web O' trust service. No different in principle from using the BaL keyserver at MIT but a lot more powerful.
The important parts of NAI's PGP (Score:2, Informative)
The important parts are the Windows infrastructure and the patented protocols that appeared in PGP5.
The Windows infrastructure is more than just the GUI - the GUI is OK, but nothing special. The infrastructure includes
- a low level secure storage driver at the OS level
- integration with many mail clients
- an Explorer shell extension to handle encrypt / decrypt, secure wipe, and verify functions
- a secure viewer with anti-tempest fonts
- the PGPNet VPN solution
- the PGPDisk secure storage solution
This is what NAI have paid to develop, and this is why it represents a major loss.Jon.