Why Not to use PGP 5.0

http://www.shub-internet.org/why_not_pgp_5.html

-----BEGIN PGP SIGNED MESSAGE-----

In <199708250009.UAA02186@yakko.cs.wmich.edu>, on 08/24/97 
   at 08:09 PM, Damaged Justice <frogfarm@yakko.cs.wmich.edu> said:

>http://www.shub-internet.org/why_not_pgp_5.html


Well I went to this web page and once again nothing but FUD.

Oh well better luck next time frogfarm,

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBNADBHI9Co1n+aLhhAQGiLwP+Jrg2UW92mmj8WDYwadnk5LixmOInSFOa
bgJNuRe3gNNTA6WiN3BOqgDPXpUZS3um2uNWAdpHenVbt7vqM6YDhV6Igephyrer
W+1pUxftCoqQAsPcqoJCyMlLy513dv1NJin4phPO4zDJi9jXcUFJsCUFNKFpJ5TZ
atopyx/H1LU=
=udz1
-----END PGP SIGNATURE-----

An entity calling itself William H. Geiger III allegedly wrote:
> >http://www.shub-internet.org/why_not_pgp_5.html
> 
> Well I went to this web page and once again nothing but FUD.
>
> Oh well better luck next time frogfarm,

I think the best luck I could have would be if some kind soul were to
explain in a little detail why the claims on the above page are FUD, for
those of us not as technically advanced as the hardcoders.

I don't write 'em; I just forwards 'em...

--
Write your representatives and complain. Demand that they institute the death
penalty for all crimes, including jaywalking, tearing the tags off mattresses
and "thinking about possibly contemplating an action which may be considered a
crime at some point in the future."  ['TruthMonger', on the cypherpunks list]

On Sun, 24 Aug 1997, Damaged Justice wrote:

> 
> http://www.shub-internet.org/why_not_pgp_5.html
> 

It sounds like a collection of gripes, some apply to the unix, but if that
works, it talks about the windows or mac version.

Some thoughts:

1-5 The scanned source generates RSA keys.  The old version generates RSA
keys so keep it around.

8-10 - then I am currently doing the impossible...  If they released it as
a "non-beta", the gripe would be that they should have kept it beta until
the very last problem is fixed. 

11 - I linked with rsaref on both an intel and alpha linux.  Lazyness or
stupidity on the part of the user is not a problem with PGP.  And where do
you get a commercial unix version of 2.6.2?  Or even the freeware - if
they aren't going to bother with RSAref with 5.0, they won't with 2.6.
And with RSAref properly configured, RSA keysize is limited.

12 - I found one problem with the alpha, and it was trivial to fix.

25 - /dev/random or other generation methods.  I notice that pgpv hangs if
there is no randseed.bin until I hit a few keys (it needs to be
/dev/urandom in many cases).  When the system has a random number
generator, why do your own?

26 - There is no problem with DH the way PGP is using it.  There are also
attacks against RSA, which PGP tries to avoid.  If you have found a real
problem, identify it, otherwise you can worry as much about RSA as DH
Also, it will accept RSA/SHA1, but won't generate them because - horrors -
that would not be compatible with the older versions and there would be
more gripes because of that. 

28 - they have -c in the unix version.  It only does 2.6 compatible
encryption.

16 - They don't document the hkp, but it seems to be just the response to
the form of a standard keyserver, so my http style scripts work.  All
keyservers still used that wierd port number, so everyone had to enable it
in their firewalls. 

Some comments with merit:

Keyservers - if pgp.com has a working one for 5.0, they should propogate
the source. 

Options - There are entries to change the conventional cipher and hash,
but these are ignored.  pgpv accepts all, but pgpe cannot generate all,
but many of these are to be "standard" or backward compatible, and that
would cause more gripes.  And if an option was not fully tested, or
available in all versions, it would be good for another gripe point. 

But the source is available.  If you don't like something, then fix it
instead of complaining.

--- reply to tzeruch - at - ceddec - dot - com ---