Re: Index for ftp site csn.org:/mpj/

>ripem/                  A subset implementation of the proposed Privacy
>                        Enhanced Mail standard.  Not as secure as PGP or
>                        Viacrypt PGP, but it is both free and free of patent
>                        infringements in the USA.
>

        I just recently got MacRipem and find it much easier to use than PGP,
        and was wondering why I should use PGP over Ripem.  The above seems to
        indicate that Ripem isn't as secure.  Why is this?


___________________________________________________________________________
"I want to know God's thoughts...the rest are details."
                                           -- Albert Einstein
_________________________________________
Ron Davis                                  rondavis@datawatch.com       
Datawatch, Research Triangle Park, NC      (919)549-0711

I just recently got MacRipem and find it much easier to use than PGP,
        and was wondering why I should use PGP over Ripem.  The above seems to
        indicate that Ripem isn't as secure.  Why is this?

I don't doubt that its much easier to use -- it was written by Ray
Lau, who is an excellent Mac/UI programmer.  The most reasonable
reasons why it might be called "less secure" is that RIPEM does not
have a signature web like PGP does.  It is possible in PEM to only
have one signature on your certificate, which can be your own
signature, or that of a CA.  Therefore, you either have the status of
"I say I am who I say I am", or a "Certification Authority says I am
who I say I am".

I hope this answeres your question.

-derek

>           A subset implementation of the proposed Privacy
>           Enhanced Mail standard.  Not as secure as PGP or
>           Viacrypt PGP, but it is both free and free of patent
>           infringements in the USA.
> 
>  I just recently got MacRipem and find it much easier to use than PGP,
>  and was wondering why I should use PGP over Ripem.  The above seems to
>  indicate that Ripem isn't as secure.  Why is this?

Bruce Schneier's (excellent!) book states that the only info available to
someone cryptanalyzing a pgp-encrypted file is the six-digit key ID.  PEM
"leaves quite a bit of information about the sender, recipient, and message
in the unencrypted header."  (p. 436)

Alan Westrope                  <awestrop@nyx10.cs.du.edu>
KeyID: 359639                  <adwestro@ouray.denver.colorado.edu>
PGP fingerprint:  D6 89 74 03 77 C8 2D 43   7C CA 6D 57 29 25 69 23
finger for public key
--
"Ah, ah...see them there!  Like Gorgons, with gray cloaks,
 and snakes coiled swarming round their bodies!  Let me go!"
 -- Aeschylus, _The Choephori_  (4larry...:-)