Subject: [Asrg] [IP] A Simpler, More Personal Key to Protect Online Messages

From: [email-masked]
Date: Mon, 07 Jul 2003 12:26:38 -0500

I thought this was interesting... any implications for us here?

One obvious issue is how this handles things like mailing lists and digests and 
such which group messages from many different original senders, and where each 
original sender has no idea of the E-mail address of the ultimate destination 
recipients.  (Would it be sufficient for the list software to decode and 
re-encode messages being processed?  But then they'd need to re-encode 
separately for each digest recipient...)

<---- Begin Forwarded Message ---->
Date: Mon, 07 Jul 2003 04:10:17 -0400
Subject: [IP] A Simpler, More Personal Key to Protect Online Messages
From: Dave Farber <[email-masked]>
To: ip <[email-masked]>
Reply-To: [email-masked]

------ Forwarded Message
From: "the terminal of Geoff Goodfellow" <[email-masked]>
Date: Mon, 7 Jul 2003 09:46:24 +0200
To: "Dave E-mail Pamphleteer Farber" <[email-masked]>
Subject: A Simpler, More Personal Key to Protect Online Messages

A Simpler, More Personal Key to Protect Online Messages

By JOHN MARKOFF
The New York Times

PALO ALTO, Calif., July 6 — A Silicon Valley start-up company on Tuesday
plans to unveil a new approach to sending secure electronic messages and
protecting data, a simpler alternative to current encryption systems, which
use long digital numbers, called public keys.

The new company, Voltage Security, which is based here, instead uses another
unique identifier as the public key: the message recipient's e-mail address.

Under the Voltage system, the sender of a message uses software that
converts the recipient's e-mail address into a number and then encrypts the
message using a mathematical formula. The recipient can then use a similar
formula in conjunction with a secret key to decode the message. The company
says it would be almost impossible for an eavesdropper to use the formula.
The software can be used with several existing PC e-mail programs.

--snip--

http://www.nytimes.com/2003/07/07/technology/07CODE.html

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
[email-masked] * Prague - CZ * telephone +420 603 706 558
"success is getting what you want & happiness is wanting what you get"
http://www.nytimes.com/library/tech/99/01/biztech/articles/17drop.html
http://www.livejournal.com/users/a2gsg/

------ End of Forwarded Message

-------------------------------------
Archives at: http://www.interesting-people.org/archives/interesting-people/

<----  End Forwarded Message  ---->

Gordon Peterson                  http://personal.terabites.com/
1977-2002  Twenty-fifth anniversary year of Local Area Networking!
Support the Anti-SPAM Amendment!  Join at http://www.cauce.org/
12/19/98: Partisan Republicans scornfully ignore the voters they "represent".
12/09/00: the date the Republican Party took down democracy in America.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 07 Jul 2003 14:08:54 -0400

Its described in detail at:

http://crypto.stanford.edu/ibe/

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 07 Jul 2003 17:16:50 -0400

Point taken.

At 02:12 PM 7/7/2003 -0700, Hallam-Baker, Phillip wrote:

The following are the message properties:

    Encrypted: No
    Signed: Yes
    Contents Altered after signing: No
    Signature Algorithm: SHA1

I finally got full net access (was on the RIM earlier)

This does look like a legit firm, it is identity based cryptography.

However it is unlikely to affect us since our problem is authentication
and not encryption. In an encryption scheme you have to know the
recipient's email before you send a message, hence the need for identity
based cryptography or a directory.

To authenticate you can send a certificate inband, so the problem that
is being solved is not really relevant to us.

                 Phill

 > -----Original Message-----
 > From: Yakov Shafranovich [mailto:[email-masked]]
 > Sent: Monday, July 07, 2003 3:46 PM
 > To: Hallam-Baker, Phillip; [email-masked]'; [email-masked]'
 > Subject: Re: [Asrg] [IP] A Simpler, More Personal Key to
 > Protect Online
 > Me ssages
 >
 >
 > The original NY Times article has this relevant quote from
 > Bruce Schneier:
 >
 > "A second challenge will be that in an increasingly online world,
 > public-key systems have become far easier to use, said Bruce
 > Schneier, a
 > cryptography expert who is founder and chief technical officer of
 > Counterpane Internet Security. "Nowadays its easy to look up
 > a key," he
 > said. "That has been solved by ubiquitous Internet access."
 >
 > At 12:03 PM 7/7/2003 -0700, Hallam-Baker, Phillip wrote:
 >
 >
 > >This sounds like it is an identity based encryption scheme
 > although it could
 > >also be snakeoil.
 > >
 > >You can think of this as a scheme where someones public key
 > is a simple
 > >function of their email address. This means that there is no need for
 > >directory infrastructure etc.
 > >
 > >The drawback is that to make the scheme work you have to
 > have a way of
 > >distributing peoples private keys from a central issuer.
 > There is no way to
 > >revoke public keys either.
 > >
 > >Most people seem to want to generate their own keypairs and
 > never reveal the
 > >private key. In practice running a directory infrastructure
 > is not a real
 > >problem. Running x500 is a problem, but dns srv records
 > pointing to an xkms
 > >server would work fine.
 > >
 > >
 > >
 > >  -----Original Message-----
 > >From:   Yakov Shafranovich
 > >Sent:   Mon Jul 07 11:44:05 2003
 > >To:     [email-masked]; [email-masked]
 > >Subject:        Re: [Asrg] [IP] A Simpler, More Personal Key
 > to Protect
 > >Online Messages
 > >
 > > >such which group messages from many different original
 > senders, and where
 > > >each
 > > >PALO ALTO, Calif., July 6 - A Silicon Valley start-up
 > company on Tuesday
 > > >The new company, Voltage Security, which is based here,
 > instead uses
 > >another
 > >Archives at:
http://www.interesting-people.org/archives/interesting-people/