[4449] in cryptography@c2.net mail archive
Re: PGP 6.5/PGPnet Announcement!
daemon@ATHENA.MIT.EDU (Steven M. Bellovin)
Tue Apr 6 10:04:31 1999
To: cryptography@c2.net
Date: Mon, 05 Apr 1999 22:21:32 -0400
From: "Steven M. Bellovin" <smb@research.att.com>
The rest of the hype aside -- and without DNSsec, their claims about
securing the whole Internet through IPsec are overblown -- this part
strikes me as very dangerous:
2. Self-Decrypting Archives. You may now encrypt
> files or folders into Self-Decrypting Archives
> (SDA) which can be sent to users who do not
> even have PGP. The archives are completely
> independent of any application, compressed
> and protected by PGP's strong cryptography.
How, pray tell, can this work? The only comparable products I've seen
work by incorporating the decryption software into a executable that you
mail to your victim, er, correspondent. This person then runs the program
they received in the mail, which then prompts them for the key... (As
an aside, I once had to explain to someone why this was an absurd
concept. "But how does your enemy know what sender to impersonate?" This,
in a threat environment sufficient to merit encrypting email....)
Most of us know that cryptography is only part of the answer to system
security, and that back doors can render useless even the strongest
ciphers. But this isn't a back door, it's the front gates wide open,
to admit the most obvious of Trojan horses.
I'm not sure where the impetus for this came from, though I'll note that
one of NAI's competitors has a product with a similar "feature". Isn't
bug compatibility wonderful?
