Re: Is there a Win PGP?

At 10:58 PM 11/6/96 -0500, you wrote:
>subject says it all.... Im just wondering is (and where) there is a windows
>version of PGP.. thanks!

There are two separate issues - PGP with a Windows GUI, and 
PGP that really runs as a Windows process, rather than needing
to fire up a DOS window.  There are a dozen or so Windows GUIs for PGP,
many of which are on ftp.ox.ac.uk.  I especially like Private Idaho;
I think the path to it is www.eskimo.com/~joelm/ (also ftp.eskimo.com).
Current version is about 2.8 ; I'm not running it because it dropped
support for ViaCrypt (due to problems with ViaCrypt 4.0), and I like
using ViaCrypt.  I'm also having problems getting the older versions
to work on Windows NT (sigh...)

For a real Windows version, you can buy ViaCrypt (about $100-130?)
At least inside the US, to use the interesting RSA methods except through the
official external interfaces to RSAREF, you need permission from RSA.
Basic PGP for DOS/Unix/Mac has this, but there isn't a blessed Windows 
version except ViaCrypt, a commercial product.  For commercial applications,
you probably also need ViaCrypt anyway.  It was a nice product before they
added Key Escrow support.  Now that Phil has bought them, they'll presumably
return to political correctness on that issue.

#			Thanks;  Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk

In <1.5.4.32.19961107072438.00dad0cc@popd.ix.netcom.com>, on 11/06/96 at 11:24 PM,
   stewarts@ix.netcom.com said:

>For commercial applications,
>you probably also need ViaCrypt anyway.  It was a nice product before they added Key
>Escrow support.  Now that Phil has bought them, they'll presumably return to
>political correctness on that issue.

Hmmm I don't think they actually had a Key Escrow Support. My understanding was that
the user could create a master key that could be used to decrypt messages from the
other keys. This was done in responce to the needs of some of their corprate users
that needed a way to decrypt company info. It could be quite devistating if a vip for
company x encrypted vital corporate files and then quit/fired/died and those file
were nolonger able to be retreived.

I am not sure exactly how they had this mechanism set up but I am pretty sure this
was somthing the user had to actively set up as aposed to somthing done automatically
with out the user's knowledge. 

I can see how this could be abused though for a GAK system though I never did see
anything from ViaCrypt that they supported any of the Clipper/GAK crap from our
government.

Does anyone know if you can purchace a commercial license from ViaCrypt/PGP Inc. but
use the standard PGP for commercial purposes?

--
-----------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    WebExplorer & Java Enhanced!!!
Cooking With Warp 4.0

Author of PGPMR2 - PGP Front End for MR/2 Ice

Look for MR/2 Tips & Rexx Scripts
Get Work Place Shell for Windows!!
PGP & MR/2 the only way for secure e-mail.
                            
Finger whgiii@amaranth.com for PGP Key and other info
-----------------------------------------------------------
 
*MR/2 ICE: The best way to accelerate Windows is at escape velocity.

On Thu, 7 Nov 1996, William H. Geiger III wrote:

> Does anyone know if you can purchace a commercial license from ViaCrypt/PGP Inc. but
> use the standard PGP for commercial purposes?
> 

Yes, that's one way of doing it.  Phil's mentioned this in his PGP doc, as
I recall.  He says, <paraphrase> 'if you use it commercially, you have to
make certain I make a buck off this - either send me one, or buy a license
from ViaCrypt."

However, you should also know that PGP Inc. (formerly called ViaCrypt)
sells *TWO* versions of the software.  The PE (or personal edition)
doesn't have the "master key" feature.  If you don't want to use the
encrypted file recovery, then don't order the software that has it.

In the BE (business edition), there's an option to force Big Brother into
every recipient list.  This means that the boss can put him/herself onto
the list of "encrypt to whom" whether you want him/her there or not.
Also, the BE recognizes some nuances in keys that the freeware doesn't:
You can have "sign only" and "encrypt only" keys.  Thus, you can give
everyone a PGP key for digital signature (because, let's say, you want
those powerful non-repudiation capabilities), but if it's a sign-only key,
they can't encrypt anything with it.

I'm also confident that these "features" are very hackable.  Someone could
easily tweak the copy of the public key for Big Brother so it encrypts to
something for which nobody (who can be found) holds the other half of the
key pair.  I'm sure there are some check digits, but I also know that it's
going to be damn hard, with software sitting on my disk on my PC, for you
to keep me locked out of it for very long.  I'm sure that Cypherpunks
could contribute something valuable in creating the "Hacking PGP 4.0
Business Edition FAQ."  Anyone for a little R&D?

The purpose (as it's been explained to me by PGP Inc.) for the BE/PE
changes was to increase the *CHOICES* that PGP users were being given
- not to change PGP into something with key escrow.  (The secret
keys still are secret - there is no escrow).  Everyone knows full
well that there are many companies who won't ever touch PGP unless it's
equipped with some "fail safe" that permits them to enforce their INFOSEC
policy.  Recovering files that were encrypted by people whom have
forgotten their pass phrases is in line with most corporate policies.

Bottom line:  Buy the version you want.  If you don't like the BE
features, then don't pay for them or use them.

------------------------------------------------------------------------- 
|It's a small world and it smells bad     |        Mark Aldrich         |
|I'd buy another if I had                 |   GRCI INFOSEC Engineering  |
|Back                                     |     maldrich@grci.com       |
|What I paid                              | MAldrich@dockmaster.ncsc.mil|
|For another mother****er in a motorcade  |Quote from "Sisters of Mercy"|
|_______________________________________________________________________|
|The author is PGP Empowered.  Public key at:  finger maldrich@grci.com |
|    The opinions expressed herein are strictly those of the author     |
|         and my employer gets no credit for them whatsoever.           |
-------------------------------------------------------------------------

On Thu, 7 Nov 1996, William H. Geiger III wrote:
> In <1.5.4.32.19961107072438.00dad0cc@popd.ix.netcom.com>, on 11/06/96 at 11:24 PM,
>    stewarts@ix.netcom.com said:
> 
> >For commercial applications,
> >you probably also need ViaCrypt anyway.  It was a nice product before they added Key
> >Escrow support.  Now that Phil has bought them, they'll presumably return to
> >political correctness on that issue.
> 
> Hmmm I don't think they actually had a Key Escrow Support. My understanding was that
> the user could create a master key that could be used to decrypt messages from the
> 
> Does anyone know if you can purchace a commercial license from ViaCrypt/PGP Inc. but
> use the standard PGP for commercial purposes?
>
> William H. Geiger III  http://www.amaranth.com/~whgiii

PGP Inc. (http://www.pgp.com/) is now marketing Viacrypt PGP.
 There are two packages, Viacrypt PGP Personal Edition which is PGP, like we 
all know and love. PE also is available as DOS, MS-Windows, Mac, and UNIX. So 
Viacrypt PGP/PE for DOS should feel similar if not identical to MIT's PGP, 
though I haven't tested it yet.
 You could license IDEA single-license and license RSAREF for commerical 
usage (http://www.consensus.com/ or JonathanZ@consensus.com), but why 
bother?
 They also have a Business Edition which supports key escrowing, not some 
US government backdoor, but a 'master key' for businesses to recover 
encrypted information if an employee forgets a passphase (which they do), 
dies (which they do, if the information is very important), is on 
vacation (sometimes it happens), etc.
 In a commerical environment, key escrowing is for data recovery, not for 
spying on employees. If you want to use your employer's email system for 
your personal email, then use a personal public key. 

 -Michael

In <Pine.OSF.3.90.961107161755.5877A-100000@olympus.mta.ca>, on 11/07/96 at 05:06 PM,
   "Michael C Taylor (CSD)" <mctaylor@olympus.mta.ca> said:

>PGP Inc. (http://www.pgp.com/) is now marketing Viacrypt PGP.
> There are two packages, Viacrypt PGP Personal Edition which is PGP, like we  all
>know and love. PE also is available as DOS, MS-Windows, Mac, and UNIX. So  Viacrypt
>PGP/PE for DOS should feel similar if not identical to MIT's PGP,  though I haven't
>tested it yet.
> You could license IDEA single-license and license RSAREF for commerical  usage
>(http://www.consensus.com/ or JonathanZ@consensus.com), but why  bother?

Well their are several reasons I myself would rather use the "free" version in a commercial enviromet:

1. Source code is not available for the ViaCrypt version.

2. No OS/2 version

3. I really don't like the Windows GUI that ViaCrypt has developed. (I am biased by the fact that I have written my own <G>).

On # 1 this is a problem for those that like to have the source code and compile the program themselfs and without the source code one is unable to run it on an unsupported platform (see #2)

On #2 this is a bussiness dicision made by ViaCrypt. I'll leave it at that. (no sense starting an OS war).

On #3 this again is just a personal preference issue and would not rate it as a big factor.

I am corresponding with PGP Inc. on the legal issues of using the "free-ware" version in a commercial enviroment.


--
-----------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    WebExplorer & Java Enhanced!!!
Cooking With Warp 4.0

Author of PGPMR2 - PGP Front End for MR/2 Ice

Look for MR/2 Tips & Rexx Scripts
Get Work Place Shell for Windows!!
PGP & MR/2 the only way for secure e-mail.
                            
Finger whgiii@amaranth.com for PGP Key and other info
-----------------------------------------------------------
 
*MR/2 ICE: "Luke!  I'm your father!"  Bill Gates, 1980

On Thu, 7 Nov 1996, William H. Geiger III wrote:
!
> I am not sure exactly how they had this mechanism set up but I am pretty sure this
> was somthing the user had to actively set up as aposed to somthing done automatically
> with out the user's knowledge. 

I have both versions.  They call it the "Business Edition", and the master
key is optional, not required.  The master key has to be in place before
anyone else generates their key, otherwise the master key won't work.  You
have to go in and turn this on so it isn't something that gets implemented
without *someone* knowing.  As for everyone else knowing that there was a
master key generated...

#include <standard.disclaimer>
                    _   __     __  _____            ____
                   / | / /__  / /_/ ___/__  _______/ __/__  _____
                  /  |/ / _ \/ __/\__ \/ / / / ___/ /_/ _ \/ ___/
                 / /|  /  __/ /_ ___/ / /_/ / /  / __/  __/ /
================/_/=|_/\___/\__//____/\__,_/_/==/_/==\___/_/===============

stewarts@ix.netcom.com wrote:
> 
> At 10:58 PM 11/6/96 -0500, you wrote:
> >subject says it all.... Im just wondering is (and where) there is a windows
> >version of PGP.. thanks!
> 
> There are two separate issues - PGP with a Windows GUI, and 
> PGP that really runs as a Windows process, rather than needing
> to fire up a DOS window.  There are a dozen or so Windows GUIs for PGP,
> many of which are on ftp.ox.ac.uk.  I especially like Private Idaho;
> I think the path to it is www.eskimo.com/~joelm/ (also ftp.eskimo.com).
> Current version is about 2.8 ; I'm not running it because it dropped
> support for ViaCrypt (due to problems with ViaCrypt 4.0), and I like
> using ViaCrypt.  I'm also having problems getting the older versions
> to work on Windows NT (sigh...)
> 
> For a real Windows version, you can buy ViaCrypt (about $100-130?)
> At least inside the US, to use the interesting RSA methods except through the
> official external interfaces to RSAREF, you need permission from RSA.
> Basic PGP for DOS/Unix/Mac has this, but there isn't a blessed Windows 
> version except ViaCrypt, a commercial product.  For commercial applications,
> you probably also need ViaCrypt anyway.  It was a nice product before they
> added Key Escrow support.  Now that Phil has bought them, they'll presumably
> return to political correctness on that issue.

I did a port of PGP to a Windows DLL a long time back, but I never got around
to releasing it. I could bring it up to date and put it out there if there is
popular demand.

Cheers,

Ben.

-- 
Ben Laurie                Phone: +44 (181) 994 6435  Email: ben@algroup.co.uk
Freelance Consultant and  Fax:   +44 (181) 994 6472
Technical Director        URL: http://www.algroup.co.uk/Apache-SSL
A.L. Digital Ltd,         Apache Group member (http://www.apache.org)
London, England.          Apache-SSL author