[47334] in Cypherpunks
Re: pgp broken?
daemon@ATHENA.MIT.EDU (Derek Atkins)
Tue Jan 16 19:42:13 1996
To: pitz@onetouch.com
Cc: cypherpunks@toad.com
In-Reply-To: Your message of "Tue, 16 Jan 1996 15:45:44."
<9601162346.AA22192@toad.com>
Date: Tue, 16 Jan 1996 19:16:36 EST
From: Derek Atkins <warlord@MIT.EDU>
Although there is always the possibility that PGP could be broken, it
is highly unlikely that the program as a whole has been broken. I
would think that it would be much easier to attempt to guess someone's
passphrase than to brute-force the crypto in the program.
Also, if it is the DoD that is purporting this supposed break, I doubt
the public will ever hear about it. It would be interesting to know
"how" PGP was supposedly broken. Was a cryptographic routine broken,
or was it a user interface break? I.e., was a signature forged or a
message decrypted? Or was an old message replayed as a new one?
Also, it could be that a small PGP key has been broken. A 384-bit PGP
key has already been broken by a factoring attack. That is neither
surprising nor alarming to say the least. Without more information it
really is impossible to analyze what happened.
-derek
