From: tjb@callisto.acpub.duke.edu (tjb)
Date: Thu, 12 Jan 95 20:56:57 PST
To: cypherpunks@toad.com
Subject: RELEASE: Secure Edit beta 0.5 (again!)
Message-ID: <199501130455.XAA28049@mail.duke.edu>
MIME-Version: 1.0
Content-Type: text/plain



I again apologize for sending this a THIRD time, but we all agree it's
important for PGP signatures to verify properly or people will get
sloppy about verifying them and expecting them to be valid. I strongly
suspect Eudora is doing some formatting of the email when I send it
with Eudora, so I'm sending this post through internews instead. This
really should work - I always paste it first in here, then check the
signature on the clipboard with macpgp. It checks out fine, but when I
send it to the list, the signature doesn't verify again.

Tom


-----BEGIN PGP SIGNED MESSAGE-----



               RELEASE: secure edit beta 0.5 for Macintosh

Miyako Software has released an improved version of secure edit. It is
now available for FTP from ripem.msu.edu in the directory
pub/crypt/mac,
and at other ITAR-compliant sites. Finger tjbryce@amherst.edu for an
updated site list, as well as information on other products by miyako
software. All releases are signed with the Miyako Software public PGP
key.

Version b0.5 sports the following new features:

FOR EASE OF USE AND UTILITY:
* extensive balloon help
* an undo command
* print command
* a find command (useful for storing sensitive information with secure
edit)
* windows menu with tile and stack commands
* copy with line breaks inserted, for composing email or pgp messages
* much better and faster compression and a smaller base file size
* secure edit now uses Colin Plumb's fast 68k assembly IDEA
implementation
* you can turn off the annoying  marks
* the menu blinking clunky has been fixed
* the window update annoyance has been fixed
* various interface clunkies have been fixed
* new and more intuitive icons have been drawn

FOR SECURITY:
* much better random number management using the code written by Colin
Plumb for PGP
* random data is snarfed from all events the application observes
(such as your keystrokes), the time these events occur, and by
continuously tracking your mouse position, even when backgrounded. the
pool of random data is maintained between sessions and is encrypted
based on these random events before it is written to disk and before
use.
* so that every file is encrypted on a different IDEA key, making
cryptanalysis of one useless agaist others, your key is salted with 128
bits of random data, stored in the clear for decryption, to make a
'session key'. thus, the key used to encrypt every file will be
different, even if you used the same passphrase. this makes
cryptanalysis of one file useless against others.
* the salt is concatenated with MD5[passphrase] many times and this
concatenated string hashed to generate the 'session key' for the file
from your pass phrase. The number of times it is concatenated is
calibrated to make it take about half a second - not a big performance
loss, but it makes brute force attack of weak passphrases up to
thousands of times more costly.
* semi-splay compression is utilized, which is faster than the lame
old compression (written by me :( ) and which gets >50% file reduction.
It strengthens the encryption by reducing the redundancy in the
plaintext. It also continually modifies the compression encoding system
based on the data as it goes along, making the interpretation of
compressed data dependent on the data that has come before it
* you can verify keys against Curve Encrypt keyfiles
* documents that are saved in plaintext format clearly distinguished
by "TEXT:" in the window title
* the source code has been cleaned up :-) and much improved to make it
easier to verify yourself that the program is strong and secure.

                           ------THE BASICS------
                           (from version a 0.3.4)

SECURE EDIT is an editor designed for editing sensitive text buffers.
It is designed to prevent plaintext from ever being written to disk,
even if only momentarily. You might fail to overwrite or encrypt such
plaintext properly, or your opponent might be able to retrieve some of
the information even though you wiped it (see docs for details). Word
Processors generally create temp and scratch files that leave plaintext
on your drive whether you like it or not. Secure edit fixes this
problem. Sometimes you need to quit in a hurry and have all your data
encrypted and saved. Or you might prefer to have your files encrypted
at
all times so that you never forget to re-encrypt a file you worked on,
and so that files are never in plaintext form while you are working
with
them. Secure edit sports the following features to serve these and
other
data security needs:

* Plaintext is never written to disk - Secure Edit locks all sensitive
buffers in memory so that virtual memory will never swap them to disk.
This includes the text you are editing as well as any encryption keys
in
use.

* Secure Edit never creates plaintext temp or scratch files

* Secure Edit offers the option of saving files directly in encrypted
format so you never have plaintext on the hard drive.
  
* Your data is compressed and encrypted in RAM with the IDEA
algorithm, then written to disk in encrypted format.
  
* Secure Edit can mantain a secure, private clipboard, interconverting
with the system clipboard only when you use OPTION-cut,copy, and paste.
This prevents the system from getting a copy of your sensitive data and
possibly writing it to disk, or leaving it around for another user to
see.
  
* Secure Edit can open foreign text files, and DOD wipe them on
request when you save the file in encrypted format.
  
* Secure Edit offers a default passphrase option so you only need to
enter your passphrase once. It also offers the option of validating
your
phrase against secure validation information that can be used to check
that you have entered your standard pass phrase, but which cannot be
used to recover the passphrase. This prevents you from saving under a
bad passphrase and losing data.
  
* Secure Edit offers a time-out option, whereby it will save all files
and quit after a certain idle time period
  
* Secure Edit offers an option-quit feature, whereby it will assume it
is okay to save all files, and save and quit as quickly as possible
  
* Secure Edit is available to U.S. citizens in the U.S. at an
ITAR-compliant site near you. I'm presently uploading it to
ripem.msu.edu and others.

* source code is, of course, available.
 
* Questions about Secure Edit should be directed to me, at
<tjb@acpub.duke.edu>

Thanks for your attention.

Tom Bryce

/////////////////////////////_\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
*---------------------------------------------------------*
Miyako Software is dedicated to creating freeware to help
make computers tools of personal liberation and expression.
for product info and PGP key, finger <tjbryce@amherst.edu>
                email: <tjb@acpub.duke.edu>
*---------------------------------------------------------*
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\_/////////////////////////////


-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBLxX0v08YjrUhOUC5AQE/UwP/eLKniLvJhYm1b1RZf0/0qY3mBUfhIMeT
R/ozIURiOD/qnfmn6Un9BAVvEBiVxivj8z6J2ByOREGO1ZYgpO1kZcEu0tZoP0eo
4fGeg652BYRqk4+Ltw3XcV1nDfudukAOoT9waiub1JsPeNDP/DuM+yt05gPNplNV
UMToRWfMgaM=
=T/QC
-----END PGP SIGNATURE-----