Slashdot Mirror
Command-Line Crypto From Phil Zimmermann, Again
They aren't paying for a pretty logo. The real reason is that the GUI version of PGP (along with other graphical encryption software, like the GNU Privacy Guard) aren't even in the same market.
Casual computer users have never laid out much money for encryption. The widespread use of PGP in its original incarnation (during the era of Zimmermann's prosecution for allowing it to be exported) can be attributed as much to its zero-dollars price as to a generalized interest in privacy. Home and hobby users are not cut out from buying Veridis's software -- for about a hundred dollars, you can buy a personal use version of the command-line version. The real money isn't in individuals keeping their tax records private, though -- Zimmermann and Veridis, like NAI (whose PGP-based product is called E-Business Server) are really aiming at commercial and governmental datacenters, and for customers willing to accept a much higher pricetag.
Insurance companies, banks, credit card processing centers, state records -- anywhere financial or otherwise confidential records are exchanged or stored en masse -- these all need encryption which works at the command-line. More precisely, they need crypto software which can work without direct human intervention at all. Instead, massive data centers need tools which can be called by scripts and other programs, so servers, or server farms, can spend their time crunching numbers rather than drawing pictures.
The name is familiar ... The commercial competition FileCrypt faces is familial -- it's the same product from NAI (sold from their McAffee division) that prevents Zimmermann and Veridis from calling their software PGP, even though NAI now labels their product E-Business Server. And though many companies have homegrown cryptographic solutions, Zimmermann says he knows of no other packaged software offering the high-volume encryption that the products from NAI or Veridis do.
And, he emphasizes, what they do is very similar. He says of the Veridis command-line product compared to NAI's, "It's drop-in compatible, identical in operation ... you could run the same perl scripts, the same command-line arguments."
If you want to buy Veridis' encryption software licensed for electronic commerce (not one-person use), hold onto your wallet: the price jumps about 50 times, to a shade under $5000, which Zimmermann describes as a bargain -- at least compared to the competition.
(Prices on the McAfee website show a one-year subscription-based license for E-Business Server starting at $6,875; $14,375 buys a perpetual license, with no included support.)
Both sides of that fence. And of competing in this case with a product that originated from his own crypto software (and his own company, PGP Inc.), Zimmermann says "I just don't really think of that as my product any more. It's in the hands of NAI, all the engineers have been fired. I just don't feel psychologically connected to that product." To look and not to sell. Especially when it comes to cryptographic software, code openness is considered not just a virtue but a near necessity. Peer-review and independent auditing, after all, are about the only ways you can tell that software isn't shuttling credit card numbers to the wrong person.The business model of selling high-priced crypto software at thousands of dollars per processor doesn't mesh well with gratis software, though. To that end, Zimmermann says the FileCrypt code will be soon be available for download and inspection under terms which he says will be similar to those under which users can download the code for PGP Corporation's version of the PGP-based desktop software. (PGP Corporation's terms are available though their source code page).
The reason command line tools are very useful is for cron jobs. I dont know how many times on a windows machine I wish that there was an command line tool to do something.
GUI is nice and all, but a command line one would work much better with procmail filters..
As well as just about every other kind of script I would assume...
libmcrypt offers all the functionality you need. I believe there are bindings for perl, php, python and plenty more It can use most common ciphers including RSA, Blowfish, etc. If you need command line compatibility with your existing code that calls pgp, a simple shell (or perl) wrapper can provide the syntactic sugar. Things like easy to use key storage, drag and drop encryption, etc. are not an issue in the kinds of setups described in the article.
y pt .html
It's so easy that one time I need a encryption for some data from php, and I couldn't get libmcrypt installed. So, I wrote a simple cgi to stream the text through and then save the encrypted contents.
I'll sell it for $5 a copy for personal use and $500 a seat for commercial. I can customize the interface at my normal rates. But you really should just check out:
http://www.gnu.org/directory/security/crypt/mcr
o/~ Join us now and share the software
If your mom wants encrypted email but doesn't know jack about computers, set her up with a free account on Hushmail (https://www.hushmail.com). Your browser must have good java support (on Linux, it seems to require Sun jvm 1.3+ and a recent version of Mozilla or Netscape). You have to wiggle your mouse around some when setting up the account to generate randomness. Then you pick a passphrase, and from there on out it's just like any other web based email, except your data is encrypted from before it leaves your computer until after it gets to the target computer.
;)
It interoperates with GPG/PGP compatible mail clients. Of course, your email to people who have no encryption support is not encrypted, but that's pretty much unavoidable
It has Bruce Schneier's stamp of approval, and for a crypto product, that's really saying something.
Check it out.
You might want to check out nmrc's ncrypt.
Some Slashdot readers complained that FileCrypt appears to compete with GPG, which is free. Let me make it clear that my intention was not to compete with GPG, but to compete with McAfee E-business Server, for which NAI charges over $14000 per copy. I wouldn't dream of suggesting that GPG users should switch to FileCrypt. In fact, I think GPG is a nice product. But some companies prefer to do busines with companies selling commercial products. That's why NAI makes millions of dollars selling their product. There's no reason why I shouldn't try to compete in that market. And, unlike the NAI product, FileCrypt can also be licensed at a far cheaper price for users who want it on their (command-line) desktop instead of a server.