Re: [NTSEC] pgp 5.0 back door

-----BEGIN PGP SIGNED MESSAGE-----

Michael Warfield <mhw@iss.net> writes to Ray Arachelian or somebody:
>...  Phil Zimmerman is an absolute religous fanatic about backdoors!
>When ViaCrypt implimented a commercial escrow feature to give companies the
>ability to issues keys where they had a key escrow, he used that as a reason
>to break their contract.  He had a "no backdoor" clause in the ViaCrypt
>agreement for PGP.  After the US goverment tried to investigate Phil into
>bankruptcy for several years, I seriously doubt he would do ANYTHING
>to assist them except to assist them into a pit somewhere...

The PGP Web site in http://www.pgp.com/products/differences.cgi has a list
of differences between PGP 5.0 (personal PGP) and PGP 4.5.x (corporate
PGP).  The corporate one includes a feature that the private one doesn't
called "message recovery".  Given Phil's fanaticism outlined above, this
presumably isn't any way to get at the plaintext without the user's
knowledge or cooperation, but just what the heck IS it?  I can't find a
description of the feature on-line.  The manual itself is on-line in PDF,
which presumably answers this question for acrobat fans.  I see nothing
about "message recovery" in the hard-copy PGP 4.5 manual.

For the guy who's concerned about backdoors in PGP 5.0 -- there's no
reason to believe there are any.  There's source out there for you to
download, and you can browse it over and compile a copy for yourself.
I recommend buying a legal copy anyway, even if you are going to use
the one you compiled yourself, to encourage makers of strong crypto
for the masses -- if you're getting value, may as well pay for it
and feel good about yourself.

	Salvo Salasio
- --------------------------------------------------------------------------
P.S. For CypherSaber CipherKnights: set your secret decoder ring
to "WriteYourCongressman" to decrypt this:

e91a 46d8 fba9 aaf5 927f 7a3f 1ded 8757 a741 4bb6 5568 3a5a f118 dc2b 11de
ebb3 e873 ffa1 d520 09ea 52b6 65c3 a42a 3d14 befa 0f3e ff09 e09a ad26 f877
aa84 4722 8ac3 770a 0aad 48a0 bf1e 9c51 2b1e a54f 8a7e 3e14 b0d1 3a84 8852
f9db d7ce 73b5 4066 d516 4d77 0395 37e2 b79c 9acd 6107 ecff 72bc e985 0ede
fcf0 eabd b903 9217 a0fc b95d 5ad7 3431 ba73 0d98 360b cef2 f863 ed54 8aa4
b0a9 6ed1 a2bb 8449 346f 1a7f f431 b8cf 95e3 b372 b0f5 c8a9 5ae1 622f d59f
c990 fd6d 3611 bc1e d842 82c7 c112 27d8 8b1e f3d8 f769 a10c d4f7 6360 dea4
f6cf feb3 e8c6 c72b 7b4a 03dc 00c4

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNC/Bm9eed+DWkqwBAQGeNwP+I857P9Tf5fJU6O6ahI3uvxmgM1jFTzJH
E05r7vhOX7oZnosUhYVni7BpYwlfusEyWFs1TzPgDDxnPveNi36mDwSEoD17A0wP
fH4767MUHkNHaVntLBbHBCbKytQKarZC0X1eLa5rvg76WJtP5WBooyLkDbURrJuR
jjQgifCV7hg=
=PIRT
-----END PGP SIGNATURE-----

--Boundary..3984.1071713735.multipart/signed
Content-Type: text/plain
Content-Transfer-Encoding: 7bit

At 12:17 PM 9/29/97 -0400, Anonymous wrote:
>The PGP Web site in http://www.pgp.com/products/differences.cgi has a list
>of differences between PGP 5.0 (personal PGP) and PGP 4.5.x (corporate
>PGP).  The corporate one includes a feature that the private one doesn't
>called "message recovery".  Given Phil's fanaticism outlined above, this
>presumably isn't any way to get at the plaintext without the user's
>knowledge or cooperation, but just what the heck IS it?  I can't find a
>description of the feature on-line.  The manual itself is on-line in PDF,
>which presumably answers this question for acrobat fans.  I see nothing
>about "message recovery" in the hard-copy PGP 4.5 manual.

It is my understanding that this is a setting to force 4.5 to encrypt all
messages to a specified key, which would be the corporate "message
recovery" key.  PGP 5.0 has a similar feature--a check box labeled "always
decrypt to default key" in the settings.  When this box is checked, the
default public key (usually one of yours) will always appear in the
recipient list when encrypting a message.  In 5.0, the default key is
visible in the recipient list, and it can easily be remived via drag and
drop.  I think that 4.5.x didn't show the key, and didn't allow the user to
remove it.


Jonathan Wienke

What part of "the right of the people to keep and bear Arms, shall not be
infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution)

PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1  3A8F 778A 7407 2928
DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA  4878 C245 D245 EAA7 0DCC
Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred.

Get your assault crypto before they ban it!

US/Canadian Windows 95/NT or Mac users:
Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/
Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html

Non-US PGP 5.0 sources:
http://www.ifi.uio.no/pgp/
http://www.heise.de/ct/pgpCA/download.shtml
ftp://ftp.pca.dfn.de/pub/pgp/V5.0/
ftp://ftp.fu-berlin.de/pub/pc/win95/pgp
ftp://ftp.fu-berlin.de/pub/mac/pgp
http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/

RSA export-o-matic:
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

--Boundary..3984.1071713735.multipart/signed
Content-Type: application/octet-stream; name="pgp00010.pgp"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="pgp00010.pgp"
Content-Description: "PGP signature"

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogUEdQIGZv
ciBQZXJzb25hbCBQcml2YWN5IDUuMApNZXNzYWdlSUQ6IFRwMG44VlhwMjc1
T1VuS0ZGMGtESU8vOEZ0UG5COG1pCgppUUEvQXdVQk5EQk4yY0pGMGtYcXB3
M01FUUw2VWdDZzhZS0xqbUNjY1FqWmV5QThsVzlRWUJRcFI3Z0FuUkN1Ckpq
TjdsbHFRZ1crVTFZQW9rUVR1MVdDWgo9Z0RoSwotLS0tLUVORCBQR1AgU0lH
TkFUVVJFLS0tLS0K
--Boundary..3984.1071713735.multipart/signed--