cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1997-10-15 - Re: Just say “No” to key recovery concerns…keep OpenPGP pure

Header Data

From: Lucky Green <shamrock@cypherpunks.to>
To: Tim May <tcmay@got.net>
Message Hash: ddc943453d8696e5037e94d2b8c8df970911e3cb14625ab1bdad780758d93726
Message ID: <Pine.BSF.3.96.971015013850.18390A-100000@pakastelohi.cypherpunks.to>
Reply To: <v03102800b06978017bc1@[207.167.93.63]>
UTC Datetime: 1997-10-15 00:13:13 UTC
Raw Date: Wed, 15 Oct 1997 08:13:13 +0800

Raw message

From: Lucky Green <shamrock@cypherpunks.to>
Date: Wed, 15 Oct 1997 08:13:13 +0800
To: Tim May <tcmay@got.net>
Subject: Re: Just say "No" to key recovery concerns...keep OpenPGP pure
In-Reply-To: <v03102800b06978017bc1@[207.167.93.63]>
Message-ID: <Pine.BSF.3.96.971015013850.18390A-100000@pakastelohi.cypherpunks.to>
MIME-Version: 1.0
Content-Type: text/plain



On Tue, 14 Oct 1997, Tim May wrote:
> (Disaster planning, for "what if Alice gets hit by a
> truck?" scenarios, are of course handled by having Alice lock up her
> private keys in her safe, or perhaps her department manager's safe,
> whatever. This is a dangerous security flaw, if the key is released, but
> has the advantage that it's a fairly conventional recovery approach, and is
> not built into the cryptosystem itself.

Tim,
The system above you are proposing is [C,G]AK, plain and simple. This is
what some companies are doing already. And it is a Bad Thing.

[Sidetrack: which is of course why PGP had to find another solution to
present to those customers already using GAK. IMHO, and I can't help but
be a bit surprised that I find myself in the minority on this
issue, at least as far as the list is concerned. What PGP did was
_elegant_.]

-- Lucky Green <shamrock@cypherpunks.to> PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"

Thread