Subject: question on Self-Decrypting Messages !!!

From: "Rezaul H. Safiuddin" <[email-masked]>
Date: Tue, 21 Aug 2001 22:50:58 -0500 (CDT)

If I encrypt a message and send it to someone who doesn't use PGP, I have
 to use SDA, and somehow give them the password to it, right ?

 Is this secured and protected the same way  as Digitally signed and
 encrypted messages that someone who has PGP would receive ?

 I am a newbie in this thing, any help and explanation will be appreciated.
 Also, what's the best way to encrypt mails if I am using 'hotmail' or
 'yahoo' ?

 Thanks  a lot.

---

From: Werner Koch <[email-masked]>
Date: 22 Aug 2001 08:46:11 +0200

>  to use SDA, and somehow give them the password to it, right ?

Don't know what SDA is, but self-decrypting messages are a *very
stupid* idea.  You receive such a message from soneone you don't know,
you are not able to check the identity of the sender, otherwise you
would have installed an OpenPGP implemnentation.  So what you do is to
allow anyone who is able to send you a message to run arbitrary code
on your box.  It may decrypt the message but you don't know what the
code does on the side.

Okay, you can check that the executable part of that message is
identical to a trusted copy you have - but so why don't use your copy
right away.  You need a shared passphrase, this indicates that you
have established a communication link to the sender by another way -
why not also installing regular software.

You can have some software installed on your box which analyzes the
self-decrypting message and compares the executable part with a known
checksum.  I can see no advantages for such a program because it will
have about the same complexity as a normal decrypting software.

And a self-decrypting thing will never be able to check a signature.

All these self-foo things have another major drawback:  They are only
able to do their job on one platform (i.e. CPU and OS).

Ciao,

  Werner

-- 
Werner Koch        Omnis enim res, quae dando non deficit, dum habetur
g10 Code GmbH      et non datur, nondum habetur, quomodo habenda est.
Privacy Solutions                                        -- Augustinus

---

From: Jon Callas <[email-masked]>
Date: Wed, 22 Aug 2001 11:17:15 -0700

>on your box.  It may decrypt the message but you don't know what the

Well, the uses are limited, but they exist. The once or twice a year you
want them, they're nice. Here's a scenario:

Your tax accountant wants the records you have from your consulting
business do they can properly get your deductions done. Said accountant
can't spell PGP. You're not in the mood to drive an hour to get there, and
you're not in the mood to teach the accountant how to do it over the phone
-- it's probably simpler and easier to just drive over there. So you bundle
the thing up in a Windows SDA, and email it to your accountant. Then you
phone the accountant up, tell them the passphrase, and it unpacks your
files for them.

The general scenario is that you want to send a message to someone who
doesn't use crypto, and isn't going to regularly use it.

	Jon

---

From: Werner Koch <[email-masked]>
Date: 22 Aug 2001 20:47:27 +0200

> phone the accountant up, tell them the passphrase, and it unpacks your

Nice feature.  So I hope that my competitor uses such a scheme, I am
in the lucky position to have control over a part of the network used
to send the mail, I catch the message add a new feature to the
decrypting code and pass it on.  Some hours laters the trojan
installed on the tax accountant's box starts to send all the
confidential files to an anonymous account somewhere....