July 2000 - Test - lists.nanog.org

RE: PGP kerserver infrastructure
by Randy Bush 03 Jul '00

03 Jul '00

> Eric and Randy's excellent contributions notwithstanding, I think the > problem is even simpler from a user's perspective: > 4) "Given my grandson's email address, send this email to him privately." > Even if the PGP key format soon expands to include attributes of many > types, it's clear that all human interaction is based on > correspondence of some kind nope. i, and many others, use pgp to encrypt files on disk should one's system be cracked, a laptop be lost, ... > SRVs are the way to go, if they enable the rapid adoption and > scaling of (1) and (2) and make (4) easier for Grandma. to use srv you have to know the domain. you have just recursed and made no progress. randy

1 0

Re: PEM(?)
by L. Sassaman 02 Jul '00

02 Jul '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sat, 1 Jul 2000, J C Lawrence wrote: > I have watched and read this thread with interest. In the end the > validity or personal preferences on the various standards is moot. > Compared to what is needed and wanted by the NANOG membership it > really just doesn't matter no matter how much you might think that > PEM/SSL/PGP/whatever are evil/great/flawed/brilliant. You're > looking to roll out a service and a basic point seems to have been > lost: actually doing something. Wouldn't it be a bit more useful to > get the thread onto the questions of: > > -- What *functionally* would be most useful to the NANOG > membership in terms of a networked key server? Do they want > SSL keys, PGP keys, SSH keys, all of them, some of them, what? > Ask! Good point. And so the question is asked... > -- What resources would be required to implement that and are > there systems already available that can be leverages to do > this or is a new development effort required? This depends on the first answer, of course. > -- Who will devote resources (machines, bandwidth, admin, > development time etc)? I have had numerous companies contact me about machines, bandwidth, and admin time for the PGP keyserver network, so that is promising. - --Len. __ L. Sassaman System Administrator | Technology Consultant | "Common sense is wrong." icq.. 10735603 | pgp.. finger://ns.quickie.net/rabbi | --Practical C Programming -----BEGIN PGP SIGNATURE----- Comment: OpenPGP Encrypted Email Preferred. iD8DBQE5X6IwPYrxsgmsCmoRApBJAKDjFPUeADMh7SJo8cFuGwHEEZiicwCfTMu8 +rtSHzqfMJM/CC7OMACs2kU= =81aT -----END PGP SIGNATURE-----

1 0

RE: PGP kerserver infrastructure
by Roeland M.J. Meyer 01 Jul '00

01 Jul '00

> From: Albert Levi: Saturday, July 01, 2000 10:04 AM > Please have a look at your wallet and see how many pieces of ID/cards > you have. I have at least 20. And they are needed for different > purposes. I cannot use my driver's license to make a payment > and cannot > use my credit card as a passport. Not only is this argument by analogy, the connections are tenuous. I hold my credit cards and Keys physically in my hand. That is much different that having a bunch of random numbers that are too long to remember. Even so, I never carry more than 3-4, of >20, credit cards, nor do I carry all my keys. In fact, I try to reduce the number of each as much as possible, even if this means consolidating combinations/numbers/keys. Granted, this didn't connect with me either, until my users started complaining. In key management, there quickly comes a point where the management itself becomes a security risk. > Similarly a user can get several > certificates for different applications. And this is necessary for > authorization purposes. Although I aggree that it is not so easy to > describe the fact of several cert necessity for SSL and PGP/PEM/S/MIME > to a non-technical person, I believe that anyone can get the > philosophy > behind the analogic difference between the car key (to get to home - > SSL) and the home key (to enter the home - PGP/PEM/...). > You'd certainly > want your kids enter home but not use your car. I'm an empty-nester, my kids don't have access. You may explain it to them, but they will only grudgingly agree. Then only because they don't know any better and you don't give them a choice. You will lose them to the first one that gives them that choice. Users don't want to know the difference between SSL POP Auth and message content encryption. To them, it is all the same. Technically, there is no reason that you can't use the same key for both. Neither to they understand the difference between Webmail and POP email, after all, the content is the same. "why do I have to have three different certs to read the same email message?" is exactly what they asked me. To be honest, I couldn't answer that satisfactorily, because there was no non-ideological answer. Technically, X.509 would indeed give it to them, PGP wont.

1 0

NSI to make (simple) change to domain-change procedures effective 8Jul00.
by rdobbins＠netmore.net 01 Jul '00

01 Jul '00

It's better than nothing, I guess. Too bad they can't seem to get PGP working. http://www.securityfocus.com/templates/article.html?id=54 ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

2 1