Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Encryption Communications Privacy Security IT

Ciphire, A Transparent, Easy PGP Alternative 345

Posted by timothy from the not-just-translucent dept.
mixter writes "Hi. I'd like to point your attention to Ciphire, a fully free and soon-to-be-audited-OpenSource 'Global PKI' project I've been working on for the last three years. As the first three or four thousand geeks started using Ciphire and seem happy, with some tech articles written, I guess the /. community might find this interesting, too. Ciphire hopes to have solved the problems that prevented PGP from a broader deployment, with even higher security standards - as already confirmed by crypto experts Housley & Ferguson. More useful information, e.g. in Wired or in the Nerd^H^H^H^Hexperts FAQ."
This discussion has been archived. No new comments can be posted.

Ciphire, A Transparent, Easy PGP Alternative More

Ciphire, A Transparent, Easy PGP Alternative

Comments Filter:

  • GPG? (Score:5, Insightful)

    by Anonymous Coward on Sunday January 23, 2005 @11:43AM (#11447803)
    What's wrong with the GNU Privacy Guard?

    • Comment removed (Score:5, Insightful)

      by account_deleted ( 4530225 ) on Sunday January 23, 2005 @12:15PM (#11447978)
      Comment removed based on user account deletion

    • Re:GPG? (Score:3, Insightful)

      by shokk ( 187512 )
      What's wrong with a little competition? I thought that's what the whole open source thing was about...providing alternatives. What works for you might not work for me...etc, etc.
    • GnuPG [gnupg.org] is fine, too. These are alternatives, and alternatives are good. I am currently adding GPG support to a popular Windows email client (will go unmentioned ;) Because GPG has been out there for some time it will have a head start for being integrated with other software. The interface, whether within UNIX software or Windows software, is easy to do to GPG but the difficulty is all the key mangement stuff. So in my case I'm assuming there's an existing installation, not handling management details. This
    • I've posted a high-level overview and commentary [davids-world.com] a couple of days ago.

      The verdict: Ciphire is a good idea in general and a fine solution for internal security in companies (across different sites), but difficult to justify as a standard due to its closed nature.

    • I have serious reservations about Ciphire. Seems more marketing than real science. I'll bet anyone of drinking age a beer that this doesn't becomes open source in 2005.

      What concerns me are comments like the following: "Each Ciphire certificate is reduced to a hash, an abbreviated mathematical identifier. Since the relationship between the hash and the certificate is reciprocal, the original hash would not match a certificate in which there was even the slightest change."

      Not so fast: (a) certificates a

  • yeah right... (Score:4, Insightful)

    by lordkuri ( 514498 ) on Sunday January 23, 2005 @11:45AM (#11447812)
    Ciphire hopes to have solved the problems that prevented PGP from a broader deployment

    so how exactly are you getting it installed and turned on by default in Outlook and Outlook Express?

    tell me I'm wrong if you want, but that's the only way you'll get Jane and Joe 6pack to use it.

    • Re:yeah right... (Score:5, Funny)

      by dq5 studios ( 682179 ) on Sunday January 23, 2005 @11:46AM (#11447820) Homepage
      so how exactly are you getting it installed and turned on by default in Outlook and Outlook Express?


      A new e-mail worm?
    • Outlook, does it really matters?

      Hotmail is the problem, and can't be fixed.

      • Re:yeah right... (Score:3, Interesting)

        by anaradad ( 199058 )
        Of course it matters. Outlook is the "approved" mail client at my work and throughout the business and educational world. If this program isn't installed by the Exchange admin or desktop support, it won't be used. Even if I wanted to use it at work, I couldn't.

      • Re:yeah right... (Score:2, Interesting)

        by dmancity ( 852553 )
        all the more reason not to use either and instead to enhance your own security.

        all computers should be sold with hardware and software firewalls, and pgp or a pgp like app built in. i wondered where phil zimmerman was (creator of pgp) and its good to see he's still around. here's a quote from his homepage where he's asked about backdoors in pgp:

        "Q: Are there any back doors in PGP? Come on, you can tell me, I won't tell anyone.

        A: No. There never have been, and never will be, at least as long as I am ass
    • What does Jane and Joe sixpack need with PGP encryption?

      I mean yeah, I'd like to see other people take privacy more seriously--if nothing else, it helps protect those of us who already take it seriously (it's a needle in a haystack sort of thing)--but people would rather read their mail instantly than have to bother remembering yet another password.
      • read their mail instantly than have to bother remembering yet another password

        A valid point. However, the gain may be worth the extra headache -- and since most POP clients already store your login password on disk and 'remember' it for you, storing a PGP passphrase would be no great trouble. If everyone had their own user account and this on-disk password was adequately protected, no big deal.

        The point is to protect the communication in transit: consider someone emailing legal documents to their lawyer

        • The employer can detect it as abnormal, depending on what kind of security they have on the network. They can set their IDS to scan traffic for specific strings (like those associated with encrypted mail) and some of them can even record traffic for at least hours if not days at a time -- terabyte RAID arrays aren't all that expensive. They may also be able to set up filters at the anti-spam server to block all outgoing messages with such encryption from certain people. All of this is available for very
          • The employer can detect it as abnormal...

            I agree. A reasonably sized corporation would have the capability to do this, much like the porn web filters that are widely deployed.

            For this particular usage scenario, it's an arms race -- certainly the company would find it easier to implement a blanket policy: no outgoing PGP encrypted email from any of our serfs. Implementing a targeted policy means that you have to get the word from the higher-ups down to the mail admins. If you (whistleblower, guy about to

      • Re:a better question (Score:5, Insightful)

        by DrSkwid ( 118965 ) on Sunday January 23, 2005 @12:19PM (#11448009) Journal
        ever heard the expression "secure by default"

        encrypted email stands out from unencrypted email

        Iif the bulk of email was encrypted then it is harder to determined that which is encrypted for a reason and that which isn't. This adds value to the use of encryption.

        I don't really need to ssh between servers on my LAN or run my vnc sessions though an ssh tunnel or use scp when I could use Samba but I do, partly because it means I am using best practices so when I am in a situation where it is desirable I am familiar with the operation and am familar with the tools I will need and not be sat there saying "bugger, I forgot to select 'use secure connection'".

        I don't really need to lock my car every time I walk 10 yards from it to the cashpoint but I do because it is best practice.

      • Re:a better question (Score:3, Insightful)

        by Alsee ( 515537 )
        Well one benefit is that if you get your social circle to adopt it as well you have a spamblocker. Any uncyphered mail can be flushed down the spambucket. And even if spammers started cyphering messages they can't forge the source, so ultimately you can flush any unapproved cypher source address the spambucket.

        -
        • If the only people you need to receive e-mail from are people in your social circle, then you don't need encryption to get rid of spam. Just use a whitelist -- much easier.

          OTOH, if you need to receive e-mail from people you don't know, then neither method works: you can't demand that they use PKI, and you can't use a whitelist.

    • Re:yeah right... (Score:5, Informative)

      by WebCrapper ( 667046 ) on Sunday January 23, 2005 @12:15PM (#11447980)
      Its actually pretty simple. I figured it out just reading the "automatically" but I'll break it down for you. Directly from their website:

      "The Ciphire Mail client resides on the user's computer between the email client and the email server, intercepting, encrypting, decrypting, signing, and authenticating email communication. During normal operation, all operations are performed in the background, making it very easy to use even for non-technical users."

      I shouldn't have to explain it any further than that here on Slashdot. Thats in the first paragraph of the Technical Explanation of how it works. Later on it lists:

      "The Ciphire Mail client consists of three parts: the core client, a graphical configuration interface, and mail connector modules (redirector). Supported email protocols include SMTP, POP3, and IMAP4. The STARTTLS and direct SSL/TLS variants of these protocols are supported as well."

      For anyone that didn't get the gist - it basically redirects your mail to its own "server process" sitting on your computer then sends it out to the normal SMTP server. This is using the same technology that the current Mail virus scanners use (Think Symantec), not new technology, just used in a different way.

      On the reverse end, the "server" checks the mail and hands it to the email client making everything secure in between.

      Pretty simple way of getting Jane and Jon Doe with OE to use it if you ask me. Granted, it needs to be installed by Admin on proper machines, but that shouldn't be too much of an issue for any company that would like to secure their email - especially if you explain and show your network admins that email is USUALLY a plain text security nightmare.
      • It also means it is the perfect point of attack for people who want to read all your e-mail. If I can find a buffer overflow in their code and send you a mail, can I get your private key sent back to me without you knowing?
    • Imagine what would happen if these guys can wrangle a deal with Apple or Dell or Gateway to include their product. The manufacture can add "Send SECURE email" to their list of features. The average Joe may not know what that means, but it implies that otherwise the email they send would be insecure.

      LK
  • I mean I know folks here on /. will find this cool and may acutally use it for mail. But, when a portion of net users have a hard time remembering thier email username and password, will this really take off? I mean PGP took off to a certain extent, but if you mention it to the average net user they look puzzled.
    • Why the hell was this modded flamebait? My father can't remember his *email address* half the time, let alone the password. There is absolutely zero chance he would ever use this, unless I could set it up for him such that he didn't have to do anything.

      If he has to do anything extra at all, it just won't happen. True, he's not typical of PC users (he's in his 60s), but most are similarly mystified by such things. They don't want to have to jump through hoops to send and receive email - just click, type, cl
      • "They don't want to have to jump through hoops to send and receive email - just click, type, click. If it's not that easy, it won't be used."

        Forget "they" I'm not going to add a layer of security unless its as easy as typing an s on the end of http or as easy as clicking an extra checkbox on the email if I want it encrypted. This is just basic UI design. If you think people will want to use a feature then make it easy for them to do so. If you think people should use a feature, then make it easy for th
    • I've used PGP on and off over the past 10 years and I can state the following:
      a) I have had big troubles with it (no backup keys, forgotten password, etc.)
      b) I have never had any problems with stolen data or damage from disclosed personal data (if it's ever happened).
      Therefore, my experience is a mixed bag - it wasn't really worth it.

      Now, with this supposedly moron-proof version (need to reboot to know if I'll be able to use it ;-)) they might reach more people, but the whole thing with password and key ma

  • Why not just use enigmail with Thunderbird? (Score:4, Insightful)

    by FyRE666 ( 263011 ) * on Sunday January 23, 2005 @11:48AM (#11447829) Homepage
    The main problem this project will encounter will be gaining momentum. PGP already has a huge userbase and infrastructure. It's not that difficult to use for anyone technically minded, and you can already buy "idiot proof" versions to plug into Outlook (I believe). For anyone using Thunderbird, the enigmail plugin offers PGP for free, which works great.

    Maybe I'm missing something?

  • Useless... (Score:5, Insightful)

    by gst ( 76126 ) on Sunday January 23, 2005 @11:49AM (#11447836) Homepage
    And what are the advantages? We already have the OpenPGP standard which is implemented by GnuPG and PGP. People who prefer free software are able to use GnuPG which is licensed under the GPL. If someone prefers commercial software he can use PGP - it even comes with a nice GUI if you use it on Windows. So let's look at your product: Non-free, No-source code, not standards complient, binaries only available for a limit number of platforms. So - in your posting you say "OpenSource" - on the webpage you write that you may publish the source in the future, but that it will only be free for non-commercial users. This is NOT OpenSource - see http://www.opensource.org/docs/definition.php for the definition what OpenSource means. Anyway, are there ANY advantages why I should even bother do download your product? Ah - don't mind - I just noticed that there aren't any LinuxPPC binaries, so I can't use it.

    • Re:Useless... (Score:3, Interesting)

      by tomstdenis ( 446163 )
      Hold on there. Some valid complaints

      - no source code
      - no free

      But the others

      - not standards compliant
      - GNUPG exists

      are not really valid. First off, tell me. Which standards does PGP [or SSH and SSL for that matter] follow? They ALL started off as homebrew projects.

      Maybe this format/protocol has improvements over PGP. [probably doesn't ... but who knows].

      As for the fact that PGP/GNUPG exists... PGP is really just bloat ware and have you seen the GNUPG source code? It's really a nightmare and the m

      • Re:Useless... (Score:3, Insightful)

        by TedCheshireAcad ( 311748 )
        PGP is a known secure cryptosystem. Fact of the matter, there is no need for new cryptosystems. We already have PGP, RSA, and Rijndael. All are known secure to the limits of computability. What work really needs to be done is protocol analysis.

        • Re:Useless... (Score:3, Insightful)

          by tomstdenis ( 446163 )
          PGP is a cryptosystem that implements the OpenPGP protocol. This program is taking things like AES and RSA and making a new protocol. It's not a new cipher design.

          Though I too question some of their choices (2 layer encryption for instance...) the idea of a new system isn't a bad one.

          Let's not forget that SSL, SSH, PGP were HOMEBREW!!! Who knows, someone may invent a system simpler, smaller, faster, more secure, more able, etc, in the future.

          For instance, for what SSL does the standard is very complic

          • Re:Useless... (Score:3, Insightful)

            by ckaminski ( 82854 )
            Because when 99% of the Internet infrastructure needs to be able to properly handle SSL, you leave nothing to chance; you spell EVERYTHING out. You'd think the TCP/IP Protocol would be fairly simple too, no?

        • Re:Useless... (Score:5, Insightful)

          by khrtt ( 701691 ) on Sunday January 23, 2005 @12:19PM (#11448005)
          1. There is no such thing as a "known secure cryptosystem". "Thought to be secure" is not the same thing, as people have proven many times over.

          2. PGP is not a cryptosystem - it's an application program. "Cryptosystem" means algorithm. It's the same thing as "cipher", essentially.

        • Re:Useless... (Score:5, Insightful)

          by mark*workfire ( 220796 ) on Sunday January 23, 2005 @02:13PM (#11448657)

          PGP is a known secure cryptosystem. Fact of the matter, there is no need for new cryptosystems.

          Well, I guess all that needs to be invented has been invented. We already have an operating system majority (Windows). There's already a major chip vendor (Intel). Antec makes the best cases, so lets just tell all the others to stop.

          Maybe, just maybe, a little mind opening is needed here? Perhaps there's something about (Cipher) that can be used in PGP, or vice versa. Slashdot is full of 'competition is a good thing' type quotes, and I'd say it applies here.

          • Take a minute to toss this one over. Let's say I'm Joe User using Windows, and it keeps crashing on me. Damn, what a piece of shit, I'd say - and maybe I'd go buy a Mac or install Linux or whatnot.

            Now let's say I'm Joe User encrypting my e-mail with some homebrew cryptosystem. Everything seems fine from my end, my e-mail is sent, and appears to be seucre, but unbeknownst to me, it's being read by my enemy, Eve, who has defeated this cryptosystem that's hardly been put through the rigors that other cry

      • Re:Useless... (Score:3, Insightful)

        by gst ( 76126 )
        RFC 2440 and RFC 3156 looks pretty much like an IETF standard to me. See http://www.ietf.org/html.charters/openpgp-charter. html for further information.

        As for the GNUPG point. As user I really don't care how the source code looks as long as it works. Further GNUPG seems more or less secure to me - there weren't that many security advisories yet.

        And if you don't want it you can use PGP - there's a freeware version of it too.

        So WHAT are the advantages of Ciphire?
        • "As for the GNUPG point. As user I really don't care how the source code looks as long as it works. Further GNUPG seems more or less secure to me - there weren't that many security advisories yet."

          How many people have really audited it? I know of dozens of crypto/network/etc/hacker types [met at CodeCon] and I bet not a one of them actually has read a line of GNUPG source code.

          Anyone who has talked with Koch would probably do the same thing I did and basically say "fuck you" and walk away.

          The source cod

      • Re:Useless... (Score:4, Informative)

        by justins ( 80659 ) on Sunday January 23, 2005 @12:25PM (#11448035) Homepage Journal
        First off, tell me. Which standards does PGP [or SSH and SSL for that matter] follow?

        http://www.ietf.org/rfc/rfc2440.txt
        • Oh, so as I understand it RFC2440 was written and THEN PGP v1 was written?

          Thanks for history v2.0

          Tom

          • Re:Useless... (Score:5, Insightful)

            by justins ( 80659 ) on Sunday January 23, 2005 @01:44PM (#11448495) Homepage Journal
            Oh, so as I understand it RFC2440 was written and THEN PGP v1 was written?


            Thanks for history v2.0

            Huh? You asked a question, I answered it.

            I certainly don't think RFC2440 is any less valid or useful for having been created after a successful implementation was created. That's how standards ought to be created. Standards created before the implementations, or in conjunction, are more likely to suck.

            The comparison with PGP and GPG is illustrative of why this new toy will not be leading to any new standards. No open source, no peer review, no new needs being addressed, no new ground being broken. Who gives a shit?
      • Comment removed based on user account deletion
        • There is a difference between making your own system/protocol and your own cipher/hash/etc. Protocols aren't that hard to write once you have some experience. Ciphers/hashes are hard to design [at least new ones with improvements] even after years of experience.

          But who says making new protocols is bad? You use PGP v1? SSL v1? SSH v1? ... If not then I call you a hypocrit.

          Tom
      • "First off, tell me. Which standards does PGP follow?"

        RFC 2440? [ietf.org] It means that you can send messages to PGP, GnuPG, and Hushmail users without them needing additional software. It means your message gets decrypted and checked automatically in KMail and TheBat, and by existing plugins for Outlook, Outlook Express, Eudora, Evolution, Mutt, Thunderbird, and Apple Mail.

        OpenPGP may have been created from PGP rather than the other way around, but you can't deny that it's the standard for encrypted and sign
  • ...and wish to subscribe to your newsletter! /Homer

    Seriously - I don't like how my first encounter with your site is when it tries to set a passel of cookies. Get on that, would ya?
  • From https://www.ciphirebeta.com/about/facts.html :

    Q: Are you going to publish your source code?
    A: Yes. Once the code is stable and we've had independent code audits, we'll publish the source code.

    Hmm, I wonder if this practice is popular among wanna-be open-source security projects. For a regular software project, I'd expect the normal cycle to be: open source it, gather feedback, improve it, and then repeat the cycle.

    However, they seem to do it in another order. Is this due to the fact that it's a secu

    • Re:Methodology for open sourcing it (Score:4, Insightful)

      by Daniel Ellard ( 799842 ) on Sunday January 23, 2005 @12:08PM (#11447939)
      This is a common problem for protocol-oriented tools of this type, at least if I correctly guess what they're thinking...

      Such tools are useful iff their interface is rigidly defined. If it starts diverging into a dozen things that look similar but aren't entirely compatible, nobody will use any of them. If, on the other hand, the system is reasonably good at the start, the probability of major forks is reduced. So sometimes it's useful to keep such projects "closed" until it's stable and complete.

      At least, I have heard such arguments made in the past. The other alternative is that the code is such an embarassing mess that they don't want anyone to see it -- I've heard that argument made as well (heck, I've got code I plan to release someday myself, as soon as I get around to adequately commenting it...).

  • not really excited (Score:4, Insightful)

    by l3v1 ( 787564 ) on Sunday January 23, 2005 @11:52AM (#11447851)
    I mean, get lost, telling us this is better than GPG won't make us run and start use this stuff. Easier to use for joesixpacks ? You mean taking GPG-key-control out of their hands and doing it in the background with some mail application ? No thanks. I know GPG, I trust GPG, I use it with many OSes and with many different applications, very easily, for both signing and encrypting. As many thousand of other people do. So you'd better think some really better arguments there, than in those linked articles.

  • How is it free or open source? (Score:5, Informative)

    by art6217 ( 757847 ) on Sunday January 23, 2005 @11:55AM (#11447871)
    From their pages: "Ciphire Mail will always be free for private users, non-profit organizations, educational institutions, and the press".
  • Yet not nerdy enough to use ^W?
    • xchat changed their key bindings to the windows versions for xchat2

      ^w closed the channel instead of deleting the word

      soon sorted that

      su
      pkg_delete xchat2

  • Does it have? (Score:2, Informative)

    by Anonymous Coward
    Whole disk SECTOR encryption? Virtual Volumes that we can mount as an NTFS folder?

    PGP Whole Disk and PGP Disk functionality is a MUST. Without it, your alternative is not an alternative at all. NEXT PLEASE.

  • I did not RTFA, but if not, I cannot tell my customers to use it no matter how easy to use it is - simply because I am not going to switch.

  • I'll stick to GPG and SSH protocols, thank you. (Score:5, Interesting)

    by Spicerun ( 551375 ) <spicerun@@@gmail...com> on Sunday January 23, 2005 @11:59AM (#11447887)
    Gee, why I'm not enthralled with Ciphire protocols:

    1) Another 'works perfectly program with WinXp, WinXX, etc.' that claims it will also support Linux/xBSD with no catches....where have I heard that one before?

    2) Another Certificates laden protocol in the footsteps of SSL. (ie - you can have security if you pay us the megabucks for that 3 month term Certificate, but ignore those Certificates easily faked, etc.) I wish SSL would die instead of being a Certificate money making machine.

    3) Another program that promises it will do everything SSH already does without the certificates....just buy a certificate to make Ciphire work.

    • just buy a certificate to make Ciphire work.

      The OpenPGP equivalent to a certificate is called a "plane ticket" whose price is called "airfare." Without a plane ticket, you often can't get your public key signed by people in the strongly connected web of trust. Without a signed public key, you can't build the web of trust, and without the web of trust, you can't verify a public key, which is the whole point of certificates.

  • Not OpenPGP Compliant and no Good reason (Score:5, Insightful)

    by Equinox11 ( 712426 ) on Sunday January 23, 2005 @11:59AM (#11447889)
    I think this product would of been great if they would of made it OpenPGP compliant, and have a method of signing your keys for a particular email address(verify email address, send a web link, click on link and you're done) If they would of implemented all the automatic sender email matching, automatic decryption, automatic signing, etc. with the current(OpenPGP) standards it would be great.. You would already have a compatible userbase & everything. But as of now I have to support two standards S/MIME and OpenPGP when communicating with people.. Why would I want to recommend to a less technical friend a 3rd one? I'll just set them up with Thunderbird/Mozilla and Enigmail(http://enigmail.mozdev.org) If you havent looked at enigmail check it out.. I'm very impressed with it, and it works fine under windos too.
  • Okay, "soon to be audited" and "I've been working on for the last three years" in the same sentence don't really inspire confidence.

  • choice of algos.... (Score:3, Insightful)

    by tomstdenis ( 446163 ) <tomstdenis@gma[ ]com ['il.' in gap]> on Sunday January 23, 2005 @12:01PM (#11447903) Homepage
    First off, encryption is done in two layers. With a 2048bit RSA and ElGamal key [both of which can be solved with GNFS ... in a shitload of time]. They
    encrypt the data with AES in CBC-HMAC mode (??? HMAC is not an encryption algo) then Twofish in CCM mode. ... WTF???

    First off, you MAC the ciphertext since it's gonna be exposed anyways. Second... CCM mode? WTF? CTR mode is simpler.

    It's like they went out of their way to overly complicate the process.

    Tom
    • I haven't really familiarised myself with what this guy is doing, but the addition of so many steps does seem a bit odd. Generally, elegant crypto is actually fairly simple. OTOH, I guess having a bunch of crypto on your message can't actually hurt much. Suppose one layer is found to have an algorithmic flaw which can be readily exploited. If you have enough layers, several would need to be cracked before it's convenient to get your message.

  • The way I see it (Score:2, Insightful)

    by Dorsai65 ( 804760 )

    it's another way to get signed/encrypted email into the hands of more people - whether they're geeks, or not. If it gets a few more people using some kind of authentication for email, then it's another strike against spammers/VXers; surely, it can't be all that bad, then, can it?

    Sure, it isn't GPG, PGP, or any of the more "traditional" encryption programs. But then, how many Joe/Jane Sixpacks do you know that use those, either? From reading the article, it seems to greatly simplify the process of installing

  • Is the source available? If not, it's snake oil.
    • Is the source available? If not, it's snake oil.

      I give you my solomn promise that it most certainly is secure, and that it is definitely NOT a sham program that simply XOR's each 8 bytes of the plaintext with DEADBEEF, 8BADF00D, or any other silly hexadecimal constant before then encrypting/compressing it via a hacked copy of pkzip.exe from 1994. I'll have that source ready for you all to see as soon as I get it reviewed by experts.

  • Transparent? Easy? (Score:3, Insightful)

    by Kickasso ( 210195 ) on Sunday January 23, 2005 @12:22PM (#11448018)
    Fuggedaboutit. There's a central server with an account for each user. There's a new GUI mail client (!) There's no compatibility with existing formats like S-MIME or PGP/GPG. Thanks, but no thanks.
  • This looks quite interesting... It makes the whole "here's my public key, now you give me mine" process much more simplified and transparent, which is really the big problem with PGP. Although pgp keyservers make this a little simplified (especially the new PGP beta server, it looks slick https://keyserver-beta.pgp.com/), the end user still has to actively search out public keys for their contacts.

    However, as with all things, corporate acceptance is probably going to be pivotal for this, especially as co
  • Looks like it uses a Ca approach, so it is secure as long as you trust them. They go to great lengths to talk about their paranoia, but it doesn't all sound right (why talk about wooden blocks?).
    They use RSA with a 2k key, and DSA with a 2k key. If they are that worried about DSA why not worry the same about RSA (1K DSA is probably stronger then 2k RSA). They use Elgamal, but don't talk about how they avoid the ciphers weaknesses (a problem the PGP community has struggled with for a long time).
    So

  • -----BEGIN PGP MESSAGE----- (Score:3, Funny)

    by Anne_Nonymous ( 313852 ) on Sunday January 23, 2005 @12:32PM (#11448079) Homepage Journal
    -----BEGIN PGP MESSAGE-----
    Version: PGPfreeware for non-commercial use

    qANQR1DBwk4D5F2YKoTmerkQC/0Tl5MChitPajOOAZQRLXqp BY RByr6Gf01kVLY2
    kB0kz4N9lx8Wh2LLMVaAtBmB+WcFbvTG1/ U1/lCK6icJn0ZPBi S8VzfG1Ia+lmhx
    O+QcYB5xKwrQwAUNx7xkh/jQ2bQ5K/wDpd YVz7EHgwxuSp5gWF GIBlErO+Qx+KR9
    svMDLPIDhn2g/4crV3Ny4Zqcd6NiuBtTpR lVr5SxrHIU7PdvCf LEdqEV2SThvHHm
    WpFuVl4Mt5L2KEYlZWWPoD8TbP1e4S40il HN45+56NUjC9bJGO 2SNuVYMxzo44fd
    V6TZRjEKyoVnp7+R2DEPR1U2ylTHtIB87N Nx8wVglD4A98K+Wv wrbvHscbdvS2Sb
    DaxqDxsAAjFy9KKgLx+M/3ylOCnXRRlE5t 8zfbIZbUusjqlfjM WEpnh4xrV4l4K9
    7ZRCbcukRSMuPqXqyKkbtakrY1ZMOC9gzQ nvZndgNSp70h6hpb L24sMfvVPUZfF9
    YphC/ufrr9yrOGiqz9FHbDoe8JAMAKRKby /GTYmfQcCCYrp1G2 SS1XWVjk5cbWsX
    aj1Py2c3Uv5rT3qRIta+8terQPBMplIqKc Rh3LMr+lAyPPRAvT RKkw8FT+msDVhL
    Nd5pwJL5HEjAVE5GeU9dxPZhZp8X9I4o3W 4C9Zh1AGqeYMOU2Q mTN/yffpoqFHi+
    VLC+ocxj4lIzFPVH1ag7MRe+OMay25A7bI 5n7RvKRGCauUoEmo zn6o8xpFdDxDl7
    7lXc5zTuhNGYtlhnFR7Cy/PRs+af4Q97v7 Smvvv6GmlBX9qsnY RFwLNt7bI8PdTe
    oBms31MZdLEu9ryUOQGzNwnz8VAe8uWYR8 rt2wN59J8lLnKzaI ZdW3mOc+TjmTrf
    zEQLmRFppwb7ALFkFY6dkrbyKi0kMCEg3T EDBNLiUARhBzJu/S ssWERg5tZHJ9NL
    1Tr0efYiD0hJ7OAwOcruelss6a7Qtsagc2 ihlyXgwj4mFuY53Z DHL5xAnRNKMxmo
    Mzf1P8wluS+FkWXQZLCcv5grFLw9xskm+9 yh/r629B9VuYW7Wr RDVaP7rdyNP7F5
    JfG97nO97bo+cpyxsrg=
    =hcA2
    ----- END PGP MESSAGE-----

  • free as in "free beer"? (Score:5, Informative)

    by g2ek ( 852570 ) on Sunday January 23, 2005 @12:39PM (#11448116)
    2. LICENSE GRANT

    (a) Subject to all of the terms and conditions set forth in this Agreement, Licensor grants to Licensee a non-exclusive, personal, non-transferable, non-sublicensable right, during the term of this Agreement, to use the Software, and the Services solely for Licensee's own Personal Use and in accordance with the applicable documentation and instructions made available by Licensor.

    (b) In no event shall Licensee distribute, display, or otherwise make available to any third party, the Software (including any copy, portion, extract, or derivative thereof).

    (c) Licensee shall not, and shall not assist, enable or otherwise permit or allow any third party to, (i) alter, adapt, modify, translate, create derivative works of, (ii) except to the extent expressly permitted by mandatory applicable law notwithstanding an agreement to the contrary, decompile, disassemble or otherwise reverse engineer or attempt to derive the source code of, or any technical data, know-how, trade secrets, processes, techniques, specifications, protocols, Key and data-formats, methods, algorithms, interfaces, ideas, solutions, structures or other information embedded or used in, (iii) rent, lend, loan, lease, sell, distribute or sublicense, or (iv) remove, alter or obscure any proprietary or restrictive notices affixed to or contained in, the Software or any copy, portion, extract or derivative thereof. In addition, Licensee shall not provide, disclose or otherwise make available the Software or any copy, portion, extract or derivative thereof, or permit use of any of the foregoing by or for the benefit of any third party (including, without limitation, on a hosting, service-bureau, time-sharing or subscription service basis).

    (d) The Software is licensed as a single product package and Licensee shall not, and shall not assist, enable or otherwise permit or allow any third party to, separate the Software, or use any component parts thereof other than as part of the Software as and in the form provided by Licensor.

    (e) Licensee shall not use the Software other than in connection with the Key-Data and the Services provided by Licensor under this Agreement.

    https://www.ciphirebeta.com/about/eula.html

    • I'm also worried about.... (Score:5, Insightful)

      by TVC15 ( 518429 ) on Sunday January 23, 2005 @01:16PM (#11448340)
      8. PRIVACY Licensee hereby expressly agrees and acknowledges that Licensor may collect, store, disclose to third parties and otherwise use and process (collectively "Process") Personal Data in connection with the Services, this Agreement and Licensee's use of the Software, and Licensee hereby authorizes Licensor (including its officers, directors, employees and agents and its suppliers and licensors) to Process Personal Data to the extent reasonably required or useful in connection with the provision of the Services and/or the execution of this Agreement, and in compliance with Licensor's current privacy policy as shown on Licensor's website (www.ciphire.com).

      whats that about?
      • The disconnect between a cryptographic program processing every one of your emails, and a license clause that says the author of same basically gives himself carte blanche to sniff whatever they damn well please should be enough to put anyone off this thing.
    • Yes, it's free beer only and not "OpenSource" as advertised in the post. This does obviously not fulfil the requirements in the FSFs Free Software Definition [gnu.org] or the OSIs Open Source Definition [opensource.org].
  • Is it just me, or does anyone else have 140 dB klaxons going off in their head when they read "soon to be audited" and "working on this for years" with regards to a cryptography project? Nobody should be insular when they're developing crypto. Ask for feedback regularly and work with the community from day one.

  • Centralized directories are bad ! (Score:5, Insightful)

    by louarnkoz ( 805588 ) on Sunday January 23, 2005 @01:07PM (#11448292)
    If you look at the little pictues "how it works" on the ciphire site, it appears that before sending a mail to Bob, Alice retrieves Bob's certificate from the ciphire central server. Really? And that is private e-mail? They must be kidding!

    What do you think will happen if someone, say in the name of the war on drugs, wants to interfere? Presto, they can convince the central server to yank Bob's key from the directory and replace it by one of their choosing. Some privacy!

  • Why does an email proxy need to take over GDM/KDM? I think I'd *much* prefer to set up the proxy seperately and simply aim my mail client at it explicitly. I'd prefer to be able to easily aim it elsewhere when I feel like it without having to log out and modify system administration.

    Allowing some closed-source commercial app (sorry, promises mean nothing: show me the source) to take over the login process and injecting an invisible proxy seems a par-tic-u-larly stupid way to solve the problem they are tr
  • From their Privacy Policy

    "Otherwise, Ciphire Labs does not forward, sell, rent, loan, trade, or lease any personal information collected at our web site or via use of Ciphire software, including email lists, to any third party, except Ciphire Labs affiliates, without the expressed consent of the user."

    Who, exactly are "Ciphire labs affiliates"?

    I would expect to see a full list of affiliates as a condition prior giving them my personal e-mail address.

    And, I would want a mechanism to prevent disclosure to
  • <conspiracy>After all, PGP/GPG is good enough for geeks, imagine if regular people started using it? Better to release a governement created cryptosystem and make it easy enough for those masses of real people to use. Then once the real people are using it, some of the geeks will switch too, and the NSA can start reading everyone's e-mail again.
    </conspiracy> ;-)
    • Very unlikely. The NSA is the U.S. intelligence agency dealing with national issues. Ciphire is a European company, based in Germany (Munich, dev labs) and Switzerland.

      If at all, it would be the German BND (Bundesnachrichtendienst), which (still) happens to have its headquarters in Munich. But don't forget that the German government funded the implementation of PKI in open source clients (I think some KDE client was used) in project Aegypten.

  • Support for triple-DES should be added! (Score:3, Insightful)

    by Eric Smith ( 4379 ) * on Sunday January 23, 2005 @03:19PM (#11449043) Homepage Journal
    Some experts think that since DES has withstood so many years of scrutiny, and there still no atack significantly better than brute force, that triple-DES may be a better choice than AES, Twofish, and Serpent, none of which have yet been subject to a comparable amount of cryptanalysis. Yet triple-DES isn't in the list on the ciphers page. Why not?

Slashdot Top Deals

One man's constant is another man's variable. -- A.J. Perlis

Close