From: eoliver@ralph.cs.haverford.edu (Erik Oliver)
Newsgroups: alt.security.pgp,alt.security.ripem
Subject: Re: PGP
Date: 6 Jan 93 16:47:32 GMT
Organization: Haverford College Computer Science Department

Well, first of all, RIPEM's command line reminds me like something from
the C compile from hell... Just trying to figure out which set of
commands fit most appropriately where was annoying.  pgp was easy to
figure out and in less than an hour I was up and running with it.  It's
key combinations were easy -k_ letter to do anything involving keys, pgp
by itself with a file name automatically decrypts, rather intelligently
I might add, and so on.

Now, I am no UNIX whimp, but, I found RIPEM's plethora of command line
options to be just too much and too poorly implemented, perhaps it is
time for some separation of the command.  Lastly, I dislike the
centralization of key verification by server, and genuinely prefer PGP's
distributed method since it allows me to build a ring of trust based
around other people I trust, not around an easily comprimised INTERNET
accessible UNIX box.

Lastly, as to the distinction between PEM and RIPEM, at least in the
original stuff concerning TIS's implementation of PEM, I remember using
the word RIPEM, perhaps that is my memory failing me.  :)

I am genuinely lookin forward to the TIS implementation because it
sounds like they've gone about fully integrating it into a mailer.  That
is definitely one of my requirements. Also, pgp is more usable in other
settings where you are not sending mail, but instead are leaving files
around.

I am certain that RIPEM has most (if not all) of the features in PGP,
but accessibility is an issue.  Lastly, I with the exception of David
Sternlight, I have yet to meet too many other people who are not using
PGP because of fear of patent laws.  So, I guess David won't be able to
read my mail, but the rest of the INTERNET will. :)

(sorry for the jab at you David, but I couldn't resist.)

Also, I return to the issue of compatibility across PEM implimentations,
RIPEM does not yet correctly impliment PEM it impliments the author's
inerpretation of PEM?  (correct me if I am wrong on this point.)  Using
various PEM implimentations is a lot like using different DES
implimentations, MacTools used to come with an encryption product with
DES as did Symantec Utilities for the Mac, although I never tried it, I
suspect that the two weren't compatible.  Yet, both used DES. Hmm...
Does this mean that I was benefiting by using DES because it was the
standard?  I don't think so.

Lastly, there is absolutely no question at this point that DES is
crackable, there are just too many people saying it, along with the
fact that the US Govt doesn't trust DES for its secret documents.
Although IDEA is not as heavily tested, at least it remains a big
question mark.  So, given the choice between encrypting my sensitive
data with a system that is known to be crackable, and a system that is a
big question mark, I will choose the latter.

Additionally, there is a civil disobedience component to using PGP which
I enjoy and think is important.

Enough incoherent blabber on my part......

-Erik
Newsgroups: alt.security.pgp,alt.security.ripem