[771] in cryptography@c2.net mail archive
Re: Full Strength Stronghold 2.0 Released Worldwide
daemon@ATHENA.MIT.EDU (Adam Shostack)
Fri May 9 13:58:55 1997
From: Adam Shostack <adam@homeport.org>
In-Reply-To: <3.0.1.32.19970508120022.00968100@cybercash.com> from Carl Ellison at "May 8, 97 12:00:22 pm"
To: cme@cybercash.com (Carl Ellison)
Date: Fri, 9 May 1997 11:57:32 -0400 (EDT)
Cc: kent@songbird.com, cryptography@c2.net, mab@research.att.com
Carl Ellison wrote:
| As the designer/implementor of one such system, I can assure you that the
| security of the key recovery "safe" can be increased as far as you desire --
| but you can't do anything about the insecurity introduced by having lost
| control over your crypto recipients. You, the owner and creator of the data
| in question, should specify precisely who can be a crypto-recipient.
Its still a fat target, where one box contains the keys to the
kingdom. Even if you have N, which is fewer than the number of
computers in the organisation, you've added a box that must be well
defended.
Its not clear that that risk is worthwhile.
Adam
--
"It is seldom that liberty of any kind is lost all at once."
-Hume
