Re: Encryption on the AS/400

Friends,

Nathan and I have been having a good conversation off line about encryption.
For humanitarian reasons he felt it would not be appropriate to discuss his
cryptography routines in this forum, an attitude I deeply respect. For more
mundane reasons I felt it would be helpful to air some of the issues here.
He has agreed to allow me to post some of the thoughts we shared.  Here is
an extract:

******************************
Patrick: "Nathan, I understand, respect, and appreciate your concerns about
divulging the
algorithm you use for encryption. I encourage you to read Phil Zimmerman's
book about his development of PGP. It has an enlightening (and humorous)
story about his own attempt to develop an encryption algorithm. I won't
spoil the story for you, but after he showed it to experts at a conference
on encryption he quickly came to the conclusion that it is more difficult
than you might think to develop strong encryption.

Most of the experts on encryption (I am certainly not one of them) believe
that you can only classify an algorithm as having strong encryption if it
has stood the scrutiny of published source and repeated challenge. PGP, SSL,
SSH, and many other applications, have readily available source and invite
attempts to challenge the algorithm. To the best of my knowledge there has
been no known successful challenge to the current release of Network
Associate's PGP encryption, and that's why it is the standard used by banks,
insurance companies, invenstment houses, and other financial institutions.

I have the highest regard for your technical expertise here in the midrange
forum, and have learned a great deal from you. However, I believe you should
not classify your solution as strong encryption without going through the
process of having it tested in a public way.

Weak or untested encryption is worse than no encryption. You may imagine
your data is protected when it is not. This can lead to a false sense of
security and unfortunate damage to your business."
******************************

Nathan's routine is certainly better than the one I cooked up some time ago.
But I believe both of us created weak cryptography by today's standards.

Thanks, Nathan, on a number of levels.
Patrick

----- Original Message -----
From: "Patrick Townsend" <patownsend@patownsend.com>
To: <midrange-l@midrange.com>
Sent: Friday, October 12, 2001 7:43 AM
Subject: Re: Encryption on the AS/400


> Nathan,
>
> Can you describe the strong encryption algorithm you are using?
>
> Patrick
> ----- Original Message -----
> From: "Nathan M. Andelin" <nandelin@relational-data.com>
> To: <midrange-l@midrange.com>
> Sent: Thursday, October 11, 2001 9:08 AM
> Subject: Re: Encryption on the AS/400
>
>
> > From: "Richard Bryant" <rbryant@quipp.com>
> >
> > > Does anyone know if there is software available
> > > that will encrypt DB2 files on the AS/400?
> >
> > Yes.  I have an ILE API that provides STRONG encryption based on a KEY
> that
> > you supply.  If interested, please contact me privately.
> >
> > Nathan M. Andelin
> > nandelin@relational-data.com
> > www.relational-data.com
> >
> >
> > _______________________________________________
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> > To post a message email: MIDRANGE-L@midrange.com
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> > or email: MIDRANGE-L-request@midrange.com
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
> >
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>