From: Mike van der Merwe <mikev@is.co.za>
Date: Mon, 19 Aug 1996 18:06:23 +0800
To: C Matthew Curtin <cmcurtin@research.megasoft.com>
Subject: Re: THE POUCH
In-Reply-To: <199608181757.NAA10242@goffette.research.megasoft.com>
Message-ID: <Pine.GSO.3.95.960819093205.27171F-100000@admin.is.co.za>
MIME-Version: 1.0
Content-Type: text/plain



Hi

>> "The POUCH is a secure e-mail terminal program for IBM compatible
>> computers. It uses a secret key phrase, advanced cryptographic
>> techniques and several UNPUBLISHED ALGORITHMS to protect data in the
>> body of e-mail messages. The key phrase, which can be up to 48 bytes
>> long, is easily remembered and communicated. The POUCH is highly
>> resistant to all known forms of cryptographic attack." [emphasis mine]

The INSTANT one see's the words "unpublished algorithms" appear in the
context of cryptography one knows that snake oil is being purveyed.
Resistant to all known forms of cryptographic attack?? Words fail me.

> Making the algorithm proprietary
> does extremely little in making it resistant to attack. All of your
> statements regarding the security of "The Pouch" are worthless, for
> you have no data with which to substantiate your claims.

Absolutely.

> If it is any good, there's no way for us to know. But your marketing
> of the product has every indication that it's nothing more than smoke
> and mirrors. To coin a phrase, "pseudocrypto."
> Please refrain from your bogus marketing techniques. This kind of
> stuff, by claiming to be "real cryptography" makes real cryptographers
> look bad.

Quite right. I'm not a "real cryptographer" myself, however I do feel that
many people on this list subscribe to a similar set of values and are
equally angered by people who sell snake oil to unsuspecting people.

Later
Mike