From: Lucky Green <shamrock@cypherpunks.to>
Date: Mon, 27 Oct 1997 14:57:17 +0800
To: mark@unicorn.com
Subject: Re: PGP Employee on MKR
In-Reply-To: <877686661.25414.193.133.230.33@unicorn.com>
Message-ID: <Pine.BSF.3.96.971027073312.10658A-100000@pakastelohi.cypherpunks.to>
MIME-Version: 1.0
Content-Type: text/plain



On Fri, 24 Oct 1997 mark@unicorn.com wrote:

> 
> If you can explain the following, then I'll accept that my fears are merely
> fantasies:

OK, I must be missing something. How can it be more evil if the email
isn't automatically sent to the owner of the MK key than if the email is
automatically cd'ed?

 > 
> 1. How PGP can prevent CMR being converted into GMR; their system builds
>    all the code required to support mandatory encryption to FBI and NSA
>    keys into every copy of PGP.

Agreed. And so did PGP 2.x and any version of PGP that allows for
encryption to multiple keys. Anybody can take the 2.6 source and hardcode
in a second recipient key.

The answer is that no PK crypto system can prevent being converted for GAK
use.


 > 2. Why PGP prefer this option to almost identical systems which do
not >    allow GMR. They don't even seem to be interested in discussing
>    alternatives.

I read the recently  proposed alternatives
and fail to see how they would prevent GMR any more than PGP's solution.
All I saw were convoluted and frequently hasty designs, many of which
lend themselves even more to GAK then what PGP did.

> Frankly, this issue seems to be the most important since Clipper, and I'm
> amazed that so many cypherpunks are so dazzled by PGP's name that they
> refuse to sit and think these issues through. 

Once, (as many of you know IMHO it is a "once", not an "if")  GAK becomes
mandatory, it can be implemented with 2.6 just a easy as
with 5.5. And it isn't PGP for Business  that will cause this to occur. It
will be some guy with a laptop who downloaded the DNA sequence for a nasty
bug to feed it  into his sequencer. Or some other act of terrorism. Heck,
perhaps a print out of old list traffic might suffice. :-)


-- Lucky Green <shamrock@cypherpunks.to> PGP encrypted email preferred.
   "Tonga? Where the hell is Tonga? They have Cypherpunks there?"