Path: utzoo!utgpu!water!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!mailrus!uwmcsd1!ig!agate!ucbvax!hplabs!hplabsz!taylor
From: taylor@hpdstma.hp.com (Dave Taylor)
Newsgroups: comp.mail.elm
Subject: Mail Encypherment
Message-ID: <2085@hplabsz.HPL.HP.COM>
Date: 6 Jul 88 17:05:57 GMT
Sender: taylor@hplabsz.HPL.HP.COM
Organization: HP University Grants Program @ The Pacific Technology Park
Lines: 48

Paul Vixie and I last night had a chance to chat about security
and electronic mail, and along the way I decided that it would be
perhaps useful for the current discussion in this group for me to 
expound on my motivations for adding the "[encode]/[clear]" feature 
to the Elm Mail System.

Basically, I don't believe that there are any really robust
encypherment systems that are quick and painless to use.  That's
okay, though, because the real reason one wants to encode mail
is to prevent unauthorized browsing of the contents *in transit*.

That is, if someone *really* wants to read your email, either
along the way or once it's arrived, then they *can* do so.  The
`cryptbreakers workbench' package is widely available, for
example, and it is reputed to be able to break the crypt(1)
function that is shipped with Unix (crypt is a partial implementation
of the DES encryption algorithm, using a shorted [simpler] 52 bit
key rather than the original [as designed at IBM] 64 bit key.  BTW:
I once talked to Dennis Ritchie about whether the simpler 
implementation was a `plot by the NSA' as widely believed and 
he laughed...)

Anyway, the point is that I think the real goal of any sort of
encypherment mechanism is to stop the unauthorized, lazy
browsing of spooled mail flowing from machine to machine.  There
are people out there who will, when bored, type commands like
"more /usr/spool/mqueue/df*" in the hopes of finding something
interesting...

The best algorithm I came up with for this purpose, actually,
was a shifting rotation scheme; instead of the +13 rotation
cipher (aka rot13) the cipher stepped from +1 to +25 then
down to +1, then down to -25 then back.  (a very simple
mathematical progression, obviously).  The criteria for
this were simple; fast, simple, and portable.

I *do* think that it would be nice to leave the option of
alternating paragraphs of hidden text and clear text too.

Anyway, back into my corner now...   ;-)

					-- Dave Taylor

ps: You will note I do not use "encryption" in this article.  When
    last in France working I was told by them, quite reasonably,
    that encryption had "crypt" as a basis, and in French that
    isn't such a lovely thought, so 'encypherment' is the more
    widely accepted international word to use in this context.