Re: Default hash

2011-02-25 Thread Robert J. Hansen
On 2/26/11 12:41 AM, John Clizbe wrote: > pg 64. Sect 4.5.7 - Which Block Cipher Should I Use? And, I forgot: I have my Kindle with me. _Practical Cryptography_ isn't available on Kindle, but _Cryptography Engineering_ is (also by Schneier). Quoting from 3.5.6, "Which Block Cipher Should I Choos

Re: Default hash

2011-02-25 Thread John Clizbe
Robert J. Hansen wrote: > On 2/25/11 10:27 PM, Aaron Toponce wrote: >> On 02/25/2011 07:39 PM, Robert J. Hansen wrote: >>> Bruce himself recommends AES over TWOFISH. >> >> [citation needed] > > _Practical Cryptography_. Read it. Other people on this list can > provide a page ref: I'm at a funer

Re: Default hash

2011-02-25 Thread Robert J. Hansen
On 2/25/11 10:27 PM, Aaron Toponce wrote: > On 02/25/2011 07:39 PM, Robert J. Hansen wrote: >> Bruce himself recommends AES over TWOFISH. > > [citation needed] _Practical Cryptography_. Read it. Other people on this list can provide a page ref: I'm at a funeral in the middle of nowhere and don'

Re: Default hash

2011-02-25 Thread Aaron Toponce
On 02/25/2011 07:39 PM, Robert J. Hansen wrote: > Bruce himself recommends AES over TWOFISH. [citation needed] I know that he's recommended AES-128 over AES-256, but I've not read where he's recommended AES over TWOFISH. >> I don't trust 3DES > > Why? Bruce himself has said that if speed isn't

Re: Default hash

2011-02-25 Thread Robert J. Hansen
On 2/25/11 6:05 PM, Aaron Toponce wrote: > I chose Twofish as my first 256-bit cipher, as I support Bruce Schneier > and it's shown to be a very robust and capable cipher, both in terms of > speed and memory usage. Bruce himself recommends AES over TWOFISH. > I don't trust 3DES Why? Bruce himse

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Aaron Toponce
On 02/24/2011 11:43 PM, Robert J. Hansen wrote: > My problem is reproducible on a stock Droid X running 2.2.something -- > just got off a very long flight, funeral in the morning: I'll dig the > precise version number tomorrow. So, I've been doing some triaging to see if I can reproduce this on ot

Re: Default hash

2011-02-25 Thread Aaron Toponce
On 02/25/2011 03:22 PM, Ben McGinnes wrote: > You shouldn't need to worry about changing the preferred order. GPG > will determine the most compatible combination of ciphers and hashes > based on the keys used to encrypt messages. For example, my preferred > symmetric cipher is AES-256, but on a

Re: Default hash

2011-02-25 Thread Ben McGinnes
On 25/02/11 12:48 AM, Aaron Toponce wrote: > > I wanted to avoid breaking from default, which was the main reason > for my post, but it appears that it's not possible if I want to use > the stronger hashes, which is fine. As long as I know the > limitations of my keys, and don't force preferences

Re: PGP/MIME considered harmful for mobile (Jameson Rollins)

2011-02-25 Thread David Schraeder
On 2/25/2011 12:56 PM, Martin Gollowitzer wrote: > * Avi [110225 19:21]: >> For those of us who use webmail, inline signatures are rather >> useful. > > There are webmail applications supporting PGP/MIME. If yours doesn't, it > is not a good one. Inline signatures are not a good thing IMHO. > >

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Daniel Kahn Gillmor
On 02/25/2011 01:37 PM, Martin Gollowitzer wrote: > Sorry for the misunderstanding: The message body is being displayed, but > the signature is not verified. K9 is the only e-mail client for Android > that I consider usable. I just received corroboration of a successful read (albeit without signat

Re: PGP/MIME considered harmful for mobile (Jameson Rollins)

2011-02-25 Thread Martin Gollowitzer
* Avi [110225 19:21]: > For those of us who use webmail, inline signatures are rather > useful. There are webmail applications supporting PGP/MIME. If yours doesn't, it is not a good one. Inline signatures are not a good thing IMHO. Martin pgpPpk4wPE5Xj.pgp Description: PGP signature _

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Martin Gollowitzer
* Daniel Kahn Gillmor [110225 18:31]: > On 02/25/2011 12:11 PM, Martin Gollowitzer wrote: > > * Patrick Brunschwig [110225 10:10]: > >> The only mail client on Android I know of to handle OpenPGP messages is > >> K9 (together with APG). But K9 only supports inline-PGP, PGP/MIME > >> messages are

Re: PGP/MIME considered harmful for mobile (Jameson Rollins)

2011-02-25 Thread Avi
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 For those of us who use webmail, inline signatures are rather useful. - -- Avi -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.11 (MingW32) - GPGshell v3.77 Comment: Most recent key: Click show in box @ http://is.gd/4xJrs iJgEAREKAEAFAk1n8lg5GGh0

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread David Shaw
On Feb 25, 2011, at 12:29 PM, Daniel Kahn Gillmor wrote: > On 02/25/2011 12:11 PM, Martin Gollowitzer wrote: >> * Patrick Brunschwig [110225 10:10]: >>> The only mail client on Android I know of to handle OpenPGP messages is >>> K9 (together with APG). But K9 only supports inline-PGP, PGP/MIME >>

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Martin Gollowitzer
* Robert J. Hansen [110225 07:47]: > > There are good reasons to prefer a PGP/MIME and S/MIME signature > > standards over inline PGP. > > And vice-versa. In inline's defense, it *works*, and PGP/MIME often > doesn't. Maybe one should think about *why* this is the case. Nevertheless, your state

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Daniel Kahn Gillmor
On 02/25/2011 12:11 PM, Martin Gollowitzer wrote: > * Patrick Brunschwig [110225 10:10]: >> The only mail client on Android I know of to handle OpenPGP messages is >> K9 (together with APG). But K9 only supports inline-PGP, PGP/MIME >> messages are not displayed. > > This is true, but K9 at least

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Martin Gollowitzer
* Patrick Brunschwig [110225 10:10]: > On 25.02.11 07:43, Robert J. Hansen wrote: > > On 2/24/11 10:15 PM, Daniel Kahn Gillmor wrote: > >> my colleague is using the application named "email", version 2.2.2 on a > >> stock 2.2.1 motorola droid. > > > > My problem is reproducible on a stock Droid X

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Patrick Brunschwig
On 25.02.11 07:43, Robert J. Hansen wrote: > On 2/24/11 10:15 PM, Daniel Kahn Gillmor wrote: >> my colleague is using the application named "email", version 2.2.2 on a >> stock 2.2.1 motorola droid. > > My problem is reproducible on a stock Droid X running 2.2.something -- > just got off a very lo

Re: PGP/MIME considered harmful for mobile

2011-02-25 Thread Ludovic Hirlimann
On 25/02/11 07:43, Robert J. Hansen wrote: > On 2/24/11 10:15 PM, Daniel Kahn Gillmor wrote: >> my colleague is using the application named "email", version 2.2.2 on a >> stock 2.2.1 motorola droid. > My problem is reproducible on a stock Droid X running 2.2.something -- > just got off a very long