From: "L. DEkel" <dekel@carmel.haifa.ac.il>
Date: Wed, 22 Nov 1995 13:09:27 +0800
To: cypherpunks@toad.com
Subject: Re: PKZIP - Encryption
Message-ID: <Pine.A32.3.91.951122064257.46049A-100000@carmel.haifa.ac.il>
MIME-Version: 1.0
Content-Type: text/plain



    "L. DEkel" writes:
>> PKZIP Encryption:
>>
>> PKZIP encryption is often said to be: Weak, "a joke" ,"a deception" etc.
>> Maybe it's time to put things in the right perspective.
>>
>> One must realize (yet again) the difference between:
>> Theoretical Cryptography - and - Practical Cryptography:

    "Perry E. Metzger" writes:
> I could see why one would want to use a weak encryption system if it
> bought you something. However, good encryption systems are as cheap to
> use as bad ones. Therefore, why ever use a bad one? If the top of the
> line lock costs the same amount as a toy lock, why buy a toy?

Your remark is basically correct, here are few clarifications:

I didn't recommended PKZIP for encryption, I said it's an Archiver that has an
option to encrypt it's files, and that Practically this encryption is not so
bad as people think.
About costs: a complete system, including hardware, to support "full armor"
for a computer, is far more expensive than using PKZIP, so the question is
again of money, but that depends of what you're trying to encrypt.
If you are a bank for example, it would make sense to spend several thousands
on such a system, if you just send your friend a letter once in a while,
containing a movies lists, than PKZIP is enough, you don't have do use say PGP.
An good opposite example is PGP: you could define it as an Encrypter which has
an archiving option (Of course it archives for the purpose of encryption),
so why not use PGP as an archiver instead of PKZIP ?
Because:
There is the question of convenience (security=1/convenience - postulate),
people don't like to pass their plaintext through several utils, where one
compresses it, the other encrypts etc., they want a convenient util to use.
But:
Who says this old postulate (security=1/convenience) is correct today ?
you can write a program/script/batch to do all sorts of dirty jobs, why not
write a multi-purpose: compression/encryption/mailing/etc. system ?
or just use a simple script/batch util to "glue" the different utils together ?
Of course it has been done: (here are some examples)
compression/encryption system - with HPACK archiver which uses PGP,
                                 the UC2 (PRO) archiver which uses 3DES.
encryption/mailing(sometimes with compression) system - PEM, RIPEM etc.
More problems there:
These utils are not "standard" as yet, many people say they want a
popular archiver where they know "everybody" use, and PKZIP is among the
popular and multi-featured among the archivers, so why,they say, would they
bother to adopt an esoteric encrypter or archiver ?
The main problem:
people are not "privacy protecting" oriented, they don't care too much about
the subject.
("who will bother to crack this system just to read my mail ?")

What do we do ? Educate them of course.
That is why the spread of knowledge in the subject is so important.
(Knowledge, not unsubstantiated rumors).

All in all, there is no reason not to use a crypto system, if you think your
privacy/safety are in danger.
I claim that in this world of compromises, choosing PKZIP is not as bad as
presented, knowledge should be passed to all user about the risks involving
the use of one system or the other, but there is too much rumors that obscure
the subject and can misguide a user, not versed in the field of cryptography.
And if you "must", choose PKZIP (it is better encrypting then none, and better
than some, like ARJ, but certainly not among the best).


,,,,,,,,,,,,,
DEkel (noXys)
'''''''''''''