Mailing List Archive

On Thu, 24 Aug 2000, Clive Jones wrote:

> Don't trust your secrets to people you don't trust. Trusting them not
> to use broken software is just another part of that issue.

It is just that all PGP >= 5 versions are broken by design/bug and
the majority of encrypted mail is send by PGP implementations. Have a
look at the key servers stats and you will see that most keys have
been created by PGP >= 5.

It is important that security audits are *really* done and not that
everyone assumes: Okay, here is the source, someone else has probably
checked it. It has been shown in the last months that this is not
true (and that includes free software and proprietary one with open
source). The "given many eyeballs, all bugs are shallow" thesis is
whishful thinking.

Werner

--
Werner Koch GnuPG key: 621CC013
OpenIT GmbH http://www.OpenIT.de

--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org

On 25 Aug, Werner Koch wrote:

> It is just that all PGP >= 5 versions are broken by design/bug and
> the majority of encrypted mail is send by PGP implementations. Have a
> look at the key servers stats and you will see that most keys have
> been created by PGP >= 5.

My key was created by gnupg, but the keyserver says Version: 5.0

> -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: 5.0
> Comment: PGP Key Server 0.9.4

When I use gpg to export it it has a different set of strings.

> -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: GnuPG v1.0.0 (SunOS)
> Comment: For info see http://www.gnupg.org

I don't feel you can use the keyserver as a guide to what versions of
pgp are being used.

-walter

Walter Truitt writes:
> On 25 Aug, Werner Koch wrote:
>
> > It is just that all PGP >= 5 versions are broken by design/bug and
> > the majority of encrypted mail is send by PGP implementations. Have a
> > look at the key servers stats and you will see that most keys have
> > been created by PGP >= 5.
>
> My key was created by gnupg, but the keyserver says Version: 5.0

My old pgp 2.6.3 RSA key is also labeled Version 5.0. Confused the hell
out of me when I saw it this first time.

> I don't feel you can use the keyserver as a guide to what versions of
> pgp are being used.

Exactly.

--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org

On Fri, 25 Aug 2000, Walter Truitt wrote:

> My key was created by gnupg, but the keyserver says Version: 5.0
>
> > -----BEGIN PGP PUBLIC KEY BLOCK-----
> > Version: 5.0
> > Comment: PGP Key Server 0.9.4

That is the armor which has nothing to do with the implemnation used
to create the key (a keyserver does not create keys)

> I don't feel you can use the keyserver as a guide to what versions of
> pgp are being used.

What I wanted to say, was that the majority of keys on the keyservers
are v4 keys as generated by PGPG >= 5 or GnuPG. You can easily see
that by looking at the algorithms: PGP 2 is not able to generate DSA
keys.

Werner



--
Werner Koch GnuPG key: 621CC013
OpenIT GmbH http://www.OpenIT.de

--
Archive is at http://lists.gnupg.org - Unsubscribe by sending mail
with a subject of "unsubscribe" to gnupg-users-request@gnupg.org