Re: PGP scripting...

It may be just me, but I am getting confused. If we keep both private and public key secret, why not use plain old symmetric cryptography? We are talking about confidentiality I thought. If we take it to non-repudiation there still are some merrits.

One of the things about public/private keys is, well, the public key can be public.

• André

Jason Coombs wrote:
> Interesting discussion -- just a point of clarity:

>>To take an extreme (and somewhat contrived) example, suppose that you
>>know that the message will either be "The deal is on" or "The deal is
>>off"; although the message would occupy at least 112 bits as ASCII,
>>you only really have one bit of data, and you would only have to
>>encrypt the two candidate messages to determine which one was actually
>>sent.

>>If there are n possible messgaes, it only takes at most n trials to
>>decrypt the message, no matter your key size(if the encrypting key is
>>known; typically it is the public key and it is known)

>>>Please do not use public key encryption for bulk data, even if
>>>you accept the long times. It is a bad idea. If there are n
>>>possible messgaes, it only takes at most n trials to decrypt
>>>the message, no matter your key size (if the encrypting key is known;
>>>typically it is the public key and it is known).
>>>This problem is justification in itself to have a two stage system
>>>for encryption of bulk data.
>>>(there is someone at counterpane that can explain it in more detail ;-)
>>
>>I'm not sure I understand the point of this message.  It seems that
>>you are saying that you can figure out the cleartext message by taking
>>the n possible cleartext messages and encrypting with the known public
>>key until you find the cipher text.  That much makes sense, but since
>>we were talking about encryption of bulk data it seems that the number
>>of possible messages would be VERY large and such an approach would
>>not be workable.
>>
>>It seems that your comment would even argue AGAINST the "two stage"
>>system that you're talking about.  The total number of possible symmetric
>>keys would be much less than the total number of possible messages.
>>
>>But then I'm a bit of a crypto ignoramus.  If you (or someone) would
Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:
Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related securityfocus.com Links
bugtraq
certification
focus-bsd
focus-ids
focus-ih
focus-linux
focus-ms
focus-sun
focus-unix-other
focus-virus
forensics
incidents
libnet
linux-secnews
ms-secnews
pen-test
secpapers
secprog
sectools
secureshell
security-basics
securityjobs
sf-news
vuln-dev
webappsec
Request more information about Pantek
>>elaborate a bit I would be grateful.

-- 
André Mariën

Ubizen  
http://www.ubizen.com
Phone   +32 16 28 70 00
Fax     +32 16 28 71 00