How Do I Do This PGP/GPG Thing?

[Marc Ferguson]

Hi,

I wanna jump on the PGP/GPG wagon, but I'm a bit confused by www.pgpi.com's
web site.  For one why does Windows and MAC get the latest version, 8, which
is 2 cycles ahead of UNIX!?

I'm using http://axion.physics.ubc.ca/pgp-begin.html as a guide.  Am I on
the right track?  Thanks.

-- 
Marc F.

www.fergytech.com
Registered Linux User: #410978

"When life gives me lemons... I make Linuxaide, hmm good stuff!" -Marc F.

[D. Hugh Redelmeier]

| From: Bill Davidsen <davidsen(a)tmr.com&gt;

| Jerry Feldman wrote:
| > On 01/17/2009 12:40 PM, Bruno Wolff III wrote:

| > > One other note is that the original version of PGP used the IDEA
| > > encryption
| > > algorithm. This algorithm is covered by a patent for a couple of years
| > > yet.

That is true

| > > So the supplied version of gpg in many distros is not going to be able to
| > > handle stuff ecnrypted with the original gpg and some old keys. This
| > > probably
| > > won't be a problem for you.

It was a problem for me this week.  I had to build a version of gpg
with IDEA support.

(As I was doing so, I flipped on the TV and came in on an episode of
NCIS at a point where they claimed this box they were about to sell to
the bad guys supported the IDEA cipher for its legacy SAs generated by
pgp.  The actual sentence didn't actually make sense but they crammed
a lot of crypto words into it.)

| > To make a long story short, some of the technology behind public key
| > encryption is based on a patent owned by MIT and leased to RSA. The
| > technology was developed by Ronald Rivest, Adi Shamir, and Leonard Adleman
| > who were at MIT at the time

(RSA == Rivest Shamir Adleman)

| > although public key encryption was originally
| > proposed at Stanford.

Publicly proposed (UK GCHQ folks invented it earliert but it was not
disclosed).

| AFAIK the patent expired last year...

The US patent on RSA expired in 2000 (I have a tee shirt celebrating that
day).  It wasn't patented in other countries.

IDEA's patents expire in 2010 and 2011 according to wikipedia.

[Jerry Feldman]

On 01/19/2009 11:33 AM, Bill Davidsen wrote:
>  Jerry Feldman wrote:
> > On 01/17/2009 12:40 PM, Bruno Wolff III wrote:
> >> On Sat, Jan 17, 2009 at 12:04:47 -0500,
> >>   "Michael H. Warfield" <mhw(a)WittsEnd.com&gt; wrote:
> >>  
> >>> Eventually, even these were forced to be relaxed for open source
> >>> software to the point where they have almost no real impact.  If you
> >>>     
> >>
> >> I think again this was done to make a free speech argument challenging
> >> the regulations moot so that they could still harrass companies when 
> >> needed.
> >>
> >> One other note is that the original version of PGP used the IDEA 
> >> encryption
> >> algorithm. This algorithm is covered by a patent for a couple of 
> >> years yet.
> >> So the supplied version of gpg in many distros is not going to be 
> >> able to
> >> handle stuff ecnrypted with the original gpg and some old keys. This 
> >> probably
> >> won't be a problem for you.
> >>
> >>   
> > To make a long story short, some of the technology behind public key 
> > encryption is based on a patent owned by MIT and leased to RSA. The 
> > technology was developed by Ronald Rivest, Adi Shamir, and Leonard 
> > Adleman who were at MIT at the time although public key encryption 
> > was originally proposed at Stanford. There was a big battle waged 
> > between RSA and Phil Zimmerman, and during that time, MIT was able to 
> > open source some of the technology. I'm being very general, because 
> > that was the subject of last December's Boston Linux and Unix meeting 
> > which we hold at MIT each month.
> >
>  AFAIK the patent expired last year...
>  
Yes it did.

-- 
Jerry Feldman <gaf(a)blu.org&gt;
Boston Linux and Unix
PGP key id: 537C5846
PGP Key fingerprint: 3D1B 8377 A3C0 A5F2 ECBB  CA3B 4607 4319 537C 5846

[Bill Davidsen]

Jerry Feldman wrote:
>  On 01/17/2009 12:40 PM, Bruno Wolff III wrote:
> > On Sat, Jan 17, 2009 at 12:04:47 -0500,
> >   "Michael H. Warfield" <mhw(a)WittsEnd.com&gt; wrote:
> >  
> >> Eventually, even these were forced to be relaxed for open source
> >> software to the point where they have almost no real impact.  If you
> >>     
> >
> > I think again this was done to make a free speech argument challenging
> > the regulations moot so that they could still harrass companies when 
> > needed.
> >
> > One other note is that the original version of PGP used the IDEA 
> > encryption
> > algorithm. This algorithm is covered by a patent for a couple of years 
> > yet.
> > So the supplied version of gpg in many distros is not going to be able to
> > handle stuff ecnrypted with the original gpg and some old keys. This 
> > probably
> > won't be a problem for you.
> >
> >   
>  To make a long story short, some of the technology behind public key 
>  encryption is based on a patent owned by MIT and leased to RSA. The 
>  technology was developed by Ronald Rivest, Adi Shamir, and Leonard 
>  Adleman who were at MIT at the time although public key encryption was 
>  originally proposed at Stanford. There was a big battle waged between 
>  RSA and Phil Zimmerman, and during that time, MIT was able to open 
>  source some of the technology. I'm being very general, because that was 
>  the subject of last December's Boston Linux and Unix meeting which we 
>  hold at MIT each month.
>   
AFAIK the patent expired last year...

-- 
Bill Davidsen <davidsen(a)tmr.com&gt;
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot

[Bruno Wolff III]

On Sat, Jan 17, 2009 at 12:04:47 -0500,
  "Michael H. Warfield" <mhw(a)WittsEnd.com&gt; wrote:
>  
>  Eventually, even these were forced to be relaxed for open source
>  software to the point where they have almost no real impact.  If you 
I think again this was done to make a free speech argument challenging
the regulations moot so that they could still harrass companies when needed.

One other note is that the original version of PGP used the IDEA encryption
algorithm. This algorithm is covered by a patent for a couple of years yet.
So the supplied version of gpg in many distros is not going to be able to
handle stuff ecnrypted with the original gpg and some old keys. This probably
won't be a problem for you.

[Michael H. Warfield]

On Fri, 2009-01-16 at 22:21 -0500, Marc Ferguson wrote:
>  Hi, 
>  I wanna jump on the PGP/GPG wagon, but I'm a bit confused by
>  www.pgpi.com's web site.  For one why does Windows and MAC get the
>  latest version, 8, which is 2 cycles ahead of UNIX!? 
	You are looking at some very old, historical, data.  You'll notice that
the date on the PGP 8 link is from 2002.  That's all from the bad ole
days of the ITAR and EAR regulations which prohibited the export of
"real" PGP (as in what is now PGP Corporation's PGP) from the United
States so we had the International PGP (pgpi) site and project that had
reimplemented PGP outside of the country so it could be made freely
available.  They accomplished that by publishing a book (dead trees
edition) of the PGP source code and then exporting the physical book
(which could not be legally restricted for export) and then people in
Europe scanned in the pages and cleaned up the resulting code and got it
to run.

	In a desperate move to prevent losing their precious export
regulations, the old ITAR crypto regulations and restrictions under the
Department of Commerce were moved to the State Department and became the
EAR regulations which then invalidated several ongoing legal challenges.
Eventually, even these were forced to be relaxed for open source
software to the point where they have almost no real impact.  If you
look at kernel.org at the section on "cryptographic software" you'll see
the legal notice that's about all that's left of any influence of the
EAR regulations on open source software.  There are now even IETF
standards for PGP in E-Mail (PGP/Mime).

	Subsequently, we have GnuPG aka GPG or Gnu Privacy Guard. That's the
OpenSource equivalent of PGP.  Any decent distribution of Linux is going
to have GPG present.  You would probably have to search real hard to
find one that didn't have GPG in the base install.  Lots of rpms and
other packages are GPG signed and can be verified.  Evolution includes
integration with GPG.  At this point, GPG and cryptography is part of
the furniture.

>  I'm using http://axion.physics.ubc.ca/pgp-begin.html as a guide. 
> Am I
>  on the right track?  Thanks. 
	Not really.  That's all out of date.

	Start here:

	http://www.gnupg.org/

	And work through the howtos.

	Maybe I need to think about warming up my PGP/GPG cryptography talk for
ALE once again.  It's been a couple of years now.

>  -- 
>  Marc F.
>  
>  www.fergytech.com
>  Registered Linux User: #410978
>  
>  "When life gives me lemons... I make Linuxaide, hmm good stuff!" -Marc
>  F. 
	Regards,
	Mike
-- 
Michael H. Warfield (AI4NB) | [phone] |  mhw(a)WittsEnd.com
   /\/\|=mhw=|\/\/          | [phone] |  http://www.wittsend.com/mhw/
   NIC whois: MHW9          | An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471        | possible worlds.  A pessimist is sure of it!

[Brian Millett]

On Fri, 2009-01-16 at 22:21 -0500, Marc Ferguson wrote:
>  Hi,
>  
>  I wanna jump on the PGP/GPG wagon, but I'm a bit confused by
>  www.pgpi.com's web site.  For one why does Windows and MAC get the
>  latest version, 8, which is 2 cycles ahead of UNIX!?
>  
>  I'm using http://axion.physics.ubc.ca/pgp-begin.html as a guide.  Am I
>  on the right track?  Thanks.
>  
>  -- 
>  Marc F.
>  
>  www.fergytech.com
>  Registered Linux User: #410978
>  
>  "When life gives me lemons... I make Linuxaide, hmm good stuff!" -Marc
>  F.
>  -- 
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>  Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines 
You know, I just use gnupg and seahorse to manage the keys.

Evolution works great with the gpg keys as does thunderbird.

See 

http://aplawrence.com/Basics/gpg.html

-- 
Brian Millett - [ Sheridan and G'Kar (re: Z'ha'dum), "Revelations"]
"And if someone is living there?"
'Then all our races stand on the end of extinction.'

[Sam Varshavchik]

Marc Ferguson writes:

>  Sorry to double-post, but I was excited when I first started
> researching.  
>  To make matters worse - I'm running into dependency issues with PGP 
>  6.5.8.  I have libstdc++.so.4.3.2-7.{x86_64, i386} installed on my Fedora 
>  10 x86_64, but this version of PGP is looking for an older version of 
>  libstdc++.
>  
>  libstdc++.so.2.8 is needed by package pgp-6.5.8-rsaref658.i386 
>  (/media/DATA/Downloads/applications/PGPcmdln_6.5.8.Lnx_FW.rpm/PGPcmdln_6.5. 
>  8_Lnx_FW.rpm) 
You're wasting time with this ancient slop. GnuPG, gpg, already in Fedora, 
is the only thing you need.

[Marc Ferguson]

On Fri, Jan 16, 2009 at 10:21 PM, Marc Ferguson <marcferguson(a)gmail.com&gt;wrote:

>  Hi,
>
>  I wanna jump on the PGP/GPG wagon, but I'm a bit confused by www.pgpi.com's
>  web site.  For one why does Windows and MAC get the latest version, 8, which
>  is 2 cycles ahead of UNIX!?
>
>  I'm using http://axion.physics.ubc.ca/pgp-begin.html as a guide.  Am I on
>  the right track?  Thanks.
>
>  --
>  Marc F.
>
>  www.fergytech.com
>  Registered Linux User: #410978
>
>  "When life gives me lemons... I make Linuxaide, hmm good stuff!" -Marc F.
>  
Sorry to double-post, but I was excited when I first started researching.
To make matters worse - I'm running into dependency issues with PGP 6.5.8.
I have libstdc++.so.4.3.2-7.{x86_64, i386} installed on my Fedora 10 x86_64,
but this version of PGP is looking for an older version of libstdc++.

libstdc++.so.2.8 is needed by package pgp-6.5.8-rsaref658.i386
(/media/DATA/Downloads/applications/PGPcmdln_6.5.8.Lnx_FW.rpm/PGPcmdln_6.5.8_Lnx_FW.rpm)

-- 
Marc F.

www.fergytech.com
Registered Linux User: #410978

"When life gives me lemons... I make Linuxaide, hmm good stuff!" -Marc F.

[Jerry Feldman]

On 01/17/2009 12:40 PM, Bruno Wolff III wrote:
>  On Sat, Jan 17, 2009 at 12:04:47 -0500,
>    "Michael H. Warfield" <mhw(a)WittsEnd.com&gt; wrote:
>    
> > Eventually, even these were forced to be relaxed for open source
> > software to the point where they have almost no real impact.  If you
> >     
>
>  I think again this was done to make a free speech argument challenging
>  the regulations moot so that they could still harrass companies when needed.
>
>  One other note is that the original version of PGP used the IDEA encryption
>  algorithm. This algorithm is covered by a patent for a couple of years yet.
>  So the supplied version of gpg in many distros is not going to be able to
>  handle stuff ecnrypted with the original gpg and some old keys. This probably
>  won't be a problem for you.
>
>     
To make a long story short, some of the technology behind public key 
encryption is based on a patent owned by MIT and leased to RSA. The 
technology was developed by Ronald Rivest, Adi Shamir, and Leonard 
Adleman who were at MIT at the time although public key encryption was 
originally proposed at Stanford. There was a big battle waged between 
RSA and Phil Zimmerman, and during that time, MIT was able to open 
source some of the technology. I'm being very general, because that was 
the subject of last December's Boston Linux and Unix meeting which we 
hold at MIT each month.

-- 
Jerry Feldman <gaf(a)blu.org&gt;
Boston Linux and Unix
PGP key id: 537C5846
PGP Key fingerprint: 3D1B 8377 A3C0 A5F2 ECBB  CA3B 4607 4319 537C 5846