Ciphire, A Transparent, Easy PGP Alternative

GPG? by Anonymous Coward · 2005-01-23 03:43 · Score: 5, Insightful

What's wrong with the GNU Privacy Guard?

Re:GPG? by digitalchinky · 2005-01-23 04:15 · Score: 4, Insightful

Absoulutely nothing. Ciphire might be 'the good guys' but how can you tell? Sure, they are 'going' to release their code, but what's in it right now?
Re:GPG? by shokk · 2005-01-23 05:07 · Score: 2, Insightful

What's wrong with a little competition? I thought that's what the whole open source thing was about...providing alternatives. What works for you might not work for me...etc, etc.

--
"Beware of he who would deny you access to information, for in his heart, he dreams himself your master."
Re:GPG? by Jsprat23 · 2005-01-23 05:37 · Score: 3, Informative

"Getting GPG to work on windows requires Cygwin, which is a pain in the ass. If it doesn't work *transparently* on Windows, there'll never be a critical mass of people using it."

This is patently untrue. I downloaded the windows binaries from gnupg.org and followed the directions on enigmail.mozdev.org and had my dad encrypting email in about 15 mins. No cygwin required.

The biggest problem we encountered was his windows clock wasn't sync'd to a time server, and I had to wait to import his key because it had been created in "the future".

yeah right... by lordkuri · 2005-01-23 03:45 · Score: 4, Insightful

Ciphire hopes to have solved the problems that prevented PGP from a broader deployment

so how exactly are you getting it installed and turned on by default in Outlook and Outlook Express?

tell me I'm wrong if you want, but that's the only way you'll get Jane and Joe 6pack to use it.

Re:yeah right... by dq5+studios · 2005-01-23 03:46 · Score: 5, Funny

so how exactly are you getting it installed and turned on by default in Outlook and Outlook Express?

A new e-mail worm?
Re:yeah right... by anaradad · 2005-01-23 04:02 · Score: 3, Interesting

Of course it matters. Outlook is the "approved" mail client at my work and throughout the business and educational world. If this program isn't installed by the Exchange admin or desktop support, it won't be used. Even if I wanted to use it at work, I couldn't.
Re:yeah right... by dmancity · 2005-01-23 04:11 · Score: 2, Interesting

all the more reason not to use either and instead to enhance your own security.

all computers should be sold with hardware and software firewalls, and pgp or a pgp like app built in. i wondered where phil zimmerman was (creator of pgp) and its good to see he's still around. here's a quote from his homepage where he's asked about backdoors in pgp:

"Q: Are there any back doors in PGP? Come on, you can tell me, I won't tell anyone.

A: No. There never have been, and never will be, at least as long as I am associated with the product. I didn't go through all this trouble just to see my product become corrupted. Besides, we publish the source code, so you can check it yourself. "

http://www.philzimmermann.com/EN/faq/index.html

i knew there was a reason i trusted phil when i used pgp. and am glad to see he's still at it, and urge anyone whos not using it, to start.
Re:yeah right... by WebCrapper · 2005-01-23 04:15 · Score: 4, Informative

Its actually pretty simple. I figured it out just reading the "automatically" but I'll break it down for you. Directly from their website:

"The Ciphire Mail client resides on the user's computer between the email client and the email server, intercepting, encrypting, decrypting, signing, and authenticating email communication. During normal operation, all operations are performed in the background, making it very easy to use even for non-technical users."

I shouldn't have to explain it any further than that here on Slashdot. Thats in the first paragraph of the Technical Explanation of how it works. Later on it lists:

"The Ciphire Mail client consists of three parts: the core client, a graphical configuration interface, and mail connector modules (redirector). Supported email protocols include SMTP, POP3, and IMAP4. The STARTTLS and direct SSL/TLS variants of these protocols are supported as well."

For anyone that didn't get the gist - it basically redirects your mail to its own "server process" sitting on your computer then sends it out to the normal SMTP server. This is using the same technology that the current Mail virus scanners use (Think Symantec), not new technology, just used in a different way.

On the reverse end, the "server" checks the mail and hands it to the email client making everything secure in between.

Pretty simple way of getting Jane and Jon Doe with OE to use it if you ask me. Granted, it needs to be installed by Admin on proper machines, but that shouldn't be too much of an issue for any company that would like to secure their email - especially if you explain and show your network admins that email is USUALLY a plain text security nightmare.

But will people use it? by Prophetic_Truth · 2005-01-23 03:45 · Score: 2, Insightful

I mean I know folks here on /. will find this cool and may acutally use it for mail. But, when a portion of net users have a hard time remembering thier email username and password, will this really take off? I mean PGP took off to a certain extent, but if you mention it to the average net user they look puzzled.

--
time is a perception of a being's consciousness
time is your 6th sense, the wierd ones are 7+

Why not just use enigmail with Thunderbird? by FyRE666 · 2005-01-23 03:48 · Score: 3, Insightful

The main problem this project will encounter will be gaining momentum. PGP already has a huge userbase and infrastructure. It's not that difficult to use for anyone technically minded, and you can already buy "idiot proof" versions to plug into Outlook (I believe). For anyone using Thunderbird, the enigmail plugin offers PGP for free, which works great.

Maybe I'm missing something?

--
Code, Hardware, stuff like that.

Re:Why not just use enigmail with Thunderbird? by NoMoreNicksLeft · 2005-01-23 03:52 · Score: 4, Insightful

I agree, but I wish enigmail would be included in thunderbird by default. The thunderbird/firefox philosophy is to include only the essentials, right? Anything else should be a plugin/extension. Well, for email, I would think that pgp is an essential, and they need to consider it such.
Re:Why not just use enigmail with Thunderbird? by Noksagt · 2005-01-23 04:54 · Score: 2, Informative

For the windows impaired, there is WinPT, which is both easy to install & has a GUI for key management.
Re:Why not just use enigmail with Thunderbird? by harky77 · 2005-01-23 05:11 · Score: 2, Interesting

normal people don't know how to do key-exchanges...that's why, and that won't go away with Enigmail.....though if you automate the key exchanges you have to trust the stupid central server, like the pgp keyserver. They are talking about a novel concept, the fingerprint system. That is supposed to prevent abuse by the central authority. If this is really true, then this would be a BIG improvement. You can find that system explained in their report. harky
Re:Why not just use enigmail with Thunderbird? by Beryllium+Sphere(tm) · 2005-01-23 05:16 · Score: 2, Informative

>you can already buy "idiot proof" versions to plug into Outlook (I believe)

I've been on the pgp-users mailing list for a long time and the Outlook plugin has been a chronic source of problems for users and developers. Apparently email client plugin interfaces are nonstandard, change with each release, and all too often buggy. The default advice to people running PGP with their mail client evolved into "use the Encrypt Current Window function", which sacrificed integration between key selection and email addressing.

If I understood what the developers said, they wanted to do PGP Universal because they couldn't stand the plugin hassles. PGP Universal and Ciphire may signal a trend toward putting the crypto downstream of the email program.

Don't underestimate usability problems as a barrier to adoption. CMU did a usability study on PGP 5.0 and the results were alarming.

Useless... by gst · 2005-01-23 03:49 · Score: 5, Insightful

And what are the advantages? We already have the OpenPGP standard which is implemented by GnuPG and PGP. People who prefer free software are able to use GnuPG which is licensed under the GPL. If someone prefers commercial software he can use PGP - it even comes with a nice GUI if you use it on Windows. So let's look at your product: Non-free, No-source code, not standards complient, binaries only available for a limit number of platforms. So - in your posting you say "OpenSource" - on the webpage you write that you may publish the source in the future, but that it will only be free for non-commercial users. This is NOT OpenSource - see http://www.opensource.org/docs/definition.php for the definition what OpenSource means. Anyway, are there ANY advantages why I should even bother do download your product? Ah - don't mind - I just noticed that there aren't any LinuxPPC binaries, so I can't use it.

Re:Useless... by tomstdenis · 2005-01-23 03:54 · Score: 2, Interesting

Hold on there. Some valid complaints

- no source code
- no free

But the others

- not standards compliant
- GNUPG exists

are not really valid. First off, tell me. Which standards does PGP [or SSH and SSL for that matter] follow? They ALL started off as homebrew projects.

Maybe this format/protocol has improvements over PGP. [probably doesn't ... but who knows].

As for the fact that PGP/GNUPG exists... PGP is really just bloat ware and have you seen the GNUPG source code? It's really a nightmare and the maintainers [... Koch] are close minded little SOBs. They don't want to make the code more readable or maintainable. So long as it runs who cares right?

Tom

--
Someday, I'll have a real sig.
Re:Useless... by TedCheshireAcad · 2005-01-23 03:59 · Score: 3, Insightful

PGP is a known secure cryptosystem. Fact of the matter, there is no need for new cryptosystems. We already have PGP, RSA, and Rijndael. All are known secure to the limits of computability. What work really needs to be done is protocol analysis.
Re:Useless... by gst · 2005-01-23 04:02 · Score: 3, Insightful

RFC 2440 and RFC 3156 looks pretty much like an IETF standard to me. See http://www.ietf.org/html.charters/openpgp-charter. html for further information.

As for the GNUPG point. As user I really don't care how the source code looks as long as it works. Further GNUPG seems more or less secure to me - there weren't that many security advisories yet.

And if you don't want it you can use PGP - there's a freeware version of it too.

So WHAT are the advantages of Ciphire?
Re:Useless... by tomstdenis · 2005-01-23 04:05 · Score: 2, Insightful

PGP is a cryptosystem that implements the OpenPGP protocol. This program is taking things like AES and RSA and making a new protocol. It's not a new cipher design.

Though I too question some of their choices (2 layer encryption for instance...) the idea of a new system isn't a bad one.

Let's not forget that SSL, SSH, PGP were HOMEBREW!!! Who knows, someone may invent a system simpler, smaller, faster, more secure, more able, etc, in the future.

For instance, for what SSL does the standard is very complicated. I mean it verifies a cert, does key handshaking then encrypt/mac data. That's not complicated. why does it require a 70 page [non-programer friendly] RFC to describe it?

I do agree that making something new for the sake of making something new isn't smart. And if that's what they did shame on them. But the fact is "new things" is what drives us anyways.

Tom

--
Someday, I'll have a real sig.
Re:Useless... by khrtt · 2005-01-23 04:19 · Score: 4, Insightful

1. There is no such thing as a "known secure cryptosystem". "Thought to be secure" is not the same thing, as people have proven many times over.

2. PGP is not a cryptosystem - it's an application program. "Cryptosystem" means algorithm. It's the same thing as "cipher", essentially.
Re:Useless... by ckaminski · 2005-01-23 04:24 · Score: 2, Insightful

Because when 99% of the Internet infrastructure needs to be able to properly handle SSL, you leave nothing to chance; you spell EVERYTHING out. You'd think the TCP/IP Protocol would be fairly simple too, no?
Re:Useless... by justins · 2005-01-23 04:25 · Score: 3, Informative

First off, tell me. Which standards does PGP [or SSH and SSL for that matter] follow?

http://www.ietf.org/rfc/rfc2440.txt

--
Now before I get modded down, I be to remind whoever might read this that what I am saying is FACT. - bogaboga
Re:Useless... by justins · 2005-01-23 05:44 · Score: 4, Insightful

Oh, so as I understand it RFC2440 was written and THEN PGP v1 was written?

Thanks for history v2.0

Huh? You asked a question, I answered it.

I certainly don't think RFC2440 is any less valid or useful for having been created after a successful implementation was created. That's how standards ought to be created. Standards created before the implementations, or in conjunction, are more likely to suck.

The comparison with PGP and GPG is illustrative of why this new toy will not be leading to any new standards. No open source, no peer review, no new needs being addressed, no new ground being broken. Who gives a shit?

--
Now before I get modded down, I be to remind whoever might read this that what I am saying is FACT. - bogaboga
Re:Useless... by mark*workfire · 2005-01-23 06:13 · Score: 5, Insightful

PGP is a known secure cryptosystem. Fact of the matter, there is no need for new cryptosystems.

Well, I guess all that needs to be invented has been invented. We already have an operating system majority (Windows). There's already a major chip vendor (Intel). Antec makes the best cases, so lets just tell all the others to stop.

Maybe, just maybe, a little mind opening is needed here? Perhaps there's something about (Cipher) that can be used in PGP, or vice versa. Slashdot is full of 'competition is a good thing' type quotes, and I'd say it applies here.

Methodology for open sourcing it by vladd_rom · 2005-01-23 03:52 · Score: 2, Interesting

From https://www.ciphirebeta.com/about/facts.html :

Q: Are you going to publish your source code?
A: Yes. Once the code is stable and we've had independent code audits, we'll publish the source code.

Hmm, I wonder if this practice is popular among wanna-be open-source security projects. For a regular software project, I'd expect the normal cycle to be: open source it, gather feedback, improve it, and then repeat the cycle.

However, they seem to do it in another order. Is this due to the fact that it's a security product? I don't see why they would do things differently, because as far as I understand it's still an "under construction" project for "testing purposes" without any implied guarantees. More eyes on the source earlier means sooner quality product delivery.

Re:Methodology for open sourcing it by Daniel+Ellard · 2005-01-23 04:08 · Score: 3, Insightful

This is a common problem for protocol-oriented tools of this type, at least if I correctly guess what they're thinking...
Such tools are useful iff their interface is rigidly defined. If it starts diverging into a dozen things that look similar but aren't entirely compatible, nobody will use any of them. If, on the other hand, the system is reasonably good at the start, the probability of major forks is reduced. So sometimes it's useful to keep such projects "closed" until it's stable and complete.
At least, I have heard such arguments made in the past. The other alternative is that the code is such an embarassing mess that they don't want anyone to see it -- I've heard that argument made as well (heck, I've got code I plan to release someday myself, as soon as I get around to adequately commenting it...).

--
Disclaimer: I work for a company, but I don't speak for them.

not really excited by l3v1 · 2005-01-23 03:52 · Score: 3, Insightful

I mean, get lost, telling us this is better than GPG won't make us run and start use this stuff. Easier to use for joesixpacks ? You mean taking GPG-key-control out of their hands and doing it in the background with some mail application ? No thanks. I know GPG, I trust GPG, I use it with many OSes and with many different applications, very easily, for both signing and encrypting. As many thousand of other people do. So you'd better think some really better arguments there, than in those linked articles.

--
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.

How is it free or open source? by art6217 · 2005-01-23 03:55 · Score: 5, Informative

From their pages: "Ciphire Mail will always be free for private users, non-profit organizations, educational institutions, and the press".

Does it have? by Anonymous Coward · 2005-01-23 03:56 · Score: 2, Informative

Whole disk SECTOR encryption? Virtual Volumes that we can mount as an NTFS folder?

PGP Whole Disk and PGP Disk functionality is a MUST. Without it, your alternative is not an alternative at all. NEXT PLEASE.

I'll stick to GPG and SSH protocols, thank you. by Spicerun · 2005-01-23 03:59 · Score: 5, Interesting

Gee, why I'm not enthralled with Ciphire protocols:

1) Another 'works perfectly program with WinXp, WinXX, etc.' that claims it will also support Linux/xBSD with no catches....where have I heard that one before?

2) Another Certificates laden protocol in the footsteps of SSL. (ie - you can have security if you pay us the megabucks for that 3 month term Certificate, but ignore those Certificates easily faked, etc.) I wish SSL would die instead of being a Certificate money making machine.

3) Another program that promises it will do everything SSH already does without the certificates....just buy a certificate to make Ciphire work.

Not OpenPGP Compliant and no Good reason by Equinox11 · 2005-01-23 03:59 · Score: 5, Insightful

I think this product would of been great if they would of made it OpenPGP compliant, and have a method of signing your keys for a particular email address(verify email address, send a web link, click on link and you're done) If they would of implemented all the automatic sender email matching, automatic decryption, automatic signing, etc. with the current(OpenPGP) standards it would be great.. You would already have a compatible userbase & everything. But as of now I have to support two standards S/MIME and OpenPGP when communicating with people.. Why would I want to recommend to a less technical friend a 3rd one? I'll just set them up with Thunderbird/Mozilla and Enigmail(http://enigmail.mozdev.org) If you havent looked at enigmail check it out.. I'm very impressed with it, and it works fine under windos too.

choice of algos.... by tomstdenis · 2005-01-23 04:01 · Score: 2, Insightful

First off, encryption is done in two layers. With a 2048bit RSA and ElGamal key [both of which can be solved with GNFS ... in a shitload of time]. They
encrypt the data with AES in CBC-HMAC mode (??? HMAC is not an encryption algo) then Twofish in CCM mode. ... WTF???

First off, you MAC the ciphertext since it's gonna be exposed anyways. Second... CCM mode? WTF? CTR mode is simpler.

It's like they went out of their way to overly complicate the process.

Tom

--
Someday, I'll have a real sig.

The way I see it by Dorsai65 · 2005-01-23 04:05 · Score: 2, Insightful

it's another way to get signed/encrypted email into the hands of more people - whether they're geeks, or not. If it gets a few more people using some kind of authentication for email, then it's another strike against spammers/VXers; surely, it can't be all that bad, then, can it?

Sure, it isn't GPG, PGP, or any of the more "traditional" encryption programs. But then, how many Joe/Jane Sixpacks do you know that use those, either? From reading the article, it seems to greatly simplify the process of installing and using email signing/encryption, and that's something that I've run into trying to get people to use GPG/PGP: "It's too complicated; I have to remember too much stuff".

It looks like the security of it is being vetted, even if the source isn't as open as some would like (yet). Fine, it isn't "perfect" from a geek point of view, and it still has a way to go before it'll work on more email clients - but it's a start at de-geeking email crypto, which is something that can only help.

--
--- Asking inconvenient questions for over 30 years...

Re:a better question by DrSkwid · 2005-01-23 04:19 · Score: 4, Insightful

ever heard the expression "secure by default"

encrypted email stands out from unencrypted email

Iif the bulk of email was encrypted then it is harder to determined that which is encrypted for a reason and that which isn't. This adds value to the use of encryption.

I don't really need to ssh between servers on my LAN or run my vnc sessions though an ssh tunnel or use scp when I could use Samba but I do, partly because it means I am using best practices so when I am in a situation where it is desirable I am familiar with the operation and am familar with the tools I will need and not be sat there saying "bugger, I forgot to select 'use secure connection'".

I don't really need to lock my car every time I walk 10 yards from it to the cashpoint but I do because it is best practice.

--
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter

Transparent? Easy? by Kickasso · 2005-01-23 04:22 · Score: 3, Insightful

Fuggedaboutit. There's a central server with an account for each user. There's a new GUI mail client (!) There's no compatibility with existing formats like S-MIME or PGP/GPG. Thanks, but no thanks.

-----BEGIN PGP MESSAGE----- by Anne_Nonymous · 2005-01-23 04:32 · Score: 3, Funny

free as in "free beer"? by g2ek · 2005-01-23 04:39 · Score: 5, Informative

2. LICENSE GRANT

(a) Subject to all of the terms and conditions set forth in this Agreement, Licensor grants to Licensee a non-exclusive, personal, non-transferable, non-sublicensable right, during the term of this Agreement, to use the Software, and the Services solely for Licensee's own Personal Use and in accordance with the applicable documentation and instructions made available by Licensor.

(b) In no event shall Licensee distribute, display, or otherwise make available to any third party, the Software (including any copy, portion, extract, or derivative thereof).

(c) Licensee shall not, and shall not assist, enable or otherwise permit or allow any third party to, (i) alter, adapt, modify, translate, create derivative works of, (ii) except to the extent expressly permitted by mandatory applicable law notwithstanding an agreement to the contrary, decompile, disassemble or otherwise reverse engineer or attempt to derive the source code of, or any technical data, know-how, trade secrets, processes, techniques, specifications, protocols, Key and data-formats, methods, algorithms, interfaces, ideas, solutions, structures or other information embedded or used in, (iii) rent, lend, loan, lease, sell, distribute or sublicense, or (iv) remove, alter or obscure any proprietary or restrictive notices affixed to or contained in, the Software or any copy, portion, extract or derivative thereof. In addition, Licensee shall not provide, disclose or otherwise make available the Software or any copy, portion, extract or derivative thereof, or permit use of any of the foregoing by or for the benefit of any third party (including, without limitation, on a hosting, service-bureau, time-sharing or subscription service basis).

(d) The Software is licensed as a single product package and Licensee shall not, and shall not assist, enable or otherwise permit or allow any third party to, separate the Software, or use any component parts thereof other than as part of the Software as and in the form provided by Licensor.

(e) Licensee shall not use the Software other than in connection with the Key-Data and the Services provided by Licensor under this Agreement.

https://www.ciphirebeta.com/about/eula.html

Re:a better question by Alsee · 2005-01-23 04:45 · Score: 2, Insightful

Well one benefit is that if you get your social circle to adopt it as well you have a spamblocker. Any uncyphered mail can be flushed down the spambucket. And even if spammers started cyphering messages they can't forge the source, so ultimately you can flush any unapproved cypher source address the spambucket.

-

--
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.

Re:a better question by Aeiri · 2005-01-23 04:59 · Score: 3, Funny

Exactly. I don't have to lock my screen every time I move 3 feet to go to the bathroom and the only people in the house are incompetent and have never even heard of Linux before, with doors that are locked and bolted and 3 inch windows, and on top of that, use this alias to start X:

alias x="startx -- -nolisten tcp &;disown;clear;logout";

So that they can't CTRL+ALT+F1 or CTRL+ALT+Backspace into a logged in tty.

It's just... wait.. now that I think of it that is a little overkill...

Centralized directories are bad ! by louarnkoz · 2005-01-23 05:07 · Score: 5, Insightful

If you look at the little pictues "how it works" on the ciphire site, it appears that before sending a mail to Bob, Alice retrieves Bob's certificate from the ciphire central server. Really? And that is private e-mail? They must be kidding!

What do you think will happen if someone, say in the name of the war on drugs, wants to interfere? Presto, they can convince the central server to yank Bob's key from the directory and replace it by one of their choosing. Some privacy!

I'm also worried about.... by TVC15 · 2005-01-23 05:16 · Score: 5, Insightful

8. PRIVACY Licensee hereby expressly agrees and acknowledges that Licensor may collect, store, disclose to third parties and otherwise use and process (collectively "Process") Personal Data in connection with the Services, this Agreement and Licensee's use of the Software, and Licensee hereby authorizes Licensor (including its officers, directors, employees and agents and its suppliers and licensors) to Process Personal Data to the extent reasonably required or useful in connection with the provision of the Services and/or the execution of this Agreement, and in compliance with Licensor's current privacy policy as shown on Licensor's website (www.ciphire.com).

whats that about?

Web of trust needs plane tickets by tepples · 2005-01-23 05:39 · Score: 2, Insightful

just buy a certificate to make Ciphire work.

The OpenPGP equivalent to a certificate is called a "plane ticket" whose price is called "airfare." Without a plane ticket, you often can't get your public key signed by people in the strongly connected web of trust. Without a signed public key, you can't build the web of trust, and without the web of trust, you can't verify a public key, which is the whole point of certificates.

Ciphire compared to PGP and S/MIME by davids-world.com · 2005-01-23 05:51 · Score: 2, Informative

I've posted a high-level overview and commentary a couple of days ago.

The verdict: Ciphire is a good idea in general and a fine solution for internal security in companies (across different sites), but difficult to justify as a standard due to its closed nature.

Re:S/MIME, anyone? by davids-world.com · 2005-01-23 06:05 · Score: 2, Interesting

For S/MIME, you'll need to retrieve the recipients public key (i.e. certificate) first, which you usually to by receiving a signed e-mail from that person. From then on, everything is easy and, honestly, more conventient than using a GPG plugin with your mail client, because mail clients support S/MIME natively.

Generating and installing your own certificate is, well, not complicated, but too much hassle for a naive user. You have to find the right function on thawte's website, enter all sorts of personal data, add and confirm your e-mail addresses, request a key and pick the right certificate type, and so on.

And in my experience, this is somewhat difficult to do on Windows for non-techie users. It's easier on the Mac, as usual. So that's where Ciphire is so much easier.

Re:Web Mail by rivercityrandom · 2005-01-23 06:19 · Score: 2, Informative

Yeah, maybe someone should come up with a webmail client that seamlessly incorporates SSL and PGP crypto--oh, wait, it's been done.

Careful: not very secure, not very trustworthy by mikep.maine · 2005-01-23 06:22 · Score: 2, Insightful

I have serious reservations about Ciphire. Seems more marketing than real science. I'll bet anyone of drinking age a beer that this doesn't becomes open source in 2005.

What concerns me are comments like the following: "Each Ciphire certificate is reduced to a hash, an abbreviated mathematical identifier. Since the relationship between the hash and the certificate is reciprocal, the original hash would not match a certificate in which there was even the slightest change."

Not so fast: (a) certificates already have a signed hash; (b) it is common practice to state which hashing algorithm is used (SHA, MD5, ...?). I hope its not homegrown hash; and (c) by definition, hash values have collision where more than one certificate can map to the same hash value.

Just cause its an open-source wannabe doesn't mean its good for you. Let's hope for the best.

--
Mike www.sharecube.com

Re:Careful: not very secure, not very trustworthy by A+Naughty+Moose · 2005-01-23 07:26 · Score: 3, Informative

I hope its not homegrown hash;

Well, according to their cryptographic functions page, they are using SHA-256 and Whirlpool-512 hashing.

Support for triple-DES should be added! by Eric+Smith · 2005-01-23 07:19 · Score: 2, Insightful

Some experts think that since DES has withstood so many years of scrutiny, and there still no atack significantly better than brute force, that triple-DES may be a better choice than AES, Twofish, and Serpent, none of which have yet been subject to a comparable amount of cryptanalysis. Yet triple-DES isn't in the list on the ciphers page. Why not?

Slashdot Mirror

Ciphire, A Transparent, Easy PGP Alternative

49 of 345 comments (clear)