Re: Windows for Workgroups 3.11

----------
| From: Derek Atkins  <warlord@MIT.EDU>
| To: Andrzej Bursztynski  <psee@sam.nask.com.pl>
| Cc:  <cypherpunks@toad.com>
| Subject: Re: Windows for Workgroups 3.11
| Date: Wednesday, July 06, 1994 7:19AM
|
| > Just wonder if anyone had a closer look at the "Advanced security" option
| > built in the Microsoft Windows for Workgroups 3.11. You can use a soft
| > of a public/private key when sending a mail via fax (Class 1) driver
| > Micrsoft Fax at Work. The key seems to be quite short and I wonder 
if that's
| > a real secure solution comparing eg. to PGP?
|
| If it really is public key, and if the keys really are quite short,
| then its probably really *not* secure.  Remember than a 129-digit
| (~425 bit) RSA key was broken in 8 months!  A 384-bit RSA key is
| therefore not secure!
|
| -derek
|

The 129 digit key was broken in 8 calendar months and not 8 CPU months, 
correct? If so then for most purposes a 129 digit key is more than 
adequate. If you are faxing a contract to someone then if the deal 
isn't signed in 8 months the odds are that information about it will 
leak from a different source than your fax. If I had information that I 
wanted to be secure for several years than I would consider using many 
more digits than 129.

As to Windows for Workgroups 3.11, I don't know anything about the 
security features that are included.

Mike.

=====================================================

Mike Markley <mmarkley@microsoft.com>

I'm not a Microsoft spokesperson. All opinions expressed here are mine.

=====================================================

Mike Markley says:
> The 129 digit key was broken in 8 calendar months and not 8 CPU months, 
> correct? If so then for most purposes a 129 digit key is more than 
> adequate. If you are faxing a contract to someone then if the deal 
> isn't signed in 8 months the odds are that information about it will 
> leak from a different source than your fax.

This isn't true. If you are signing the contract digitally, for
instance, you would want to be sure that no one could forge your
signature to change the terms after the fact -- a few months isn't
enough for such purposes, only something that will last for fifteen or
twenty years is okay.

Perry