|
Friends, Nathan and I have been having a good conversation off line about encryption. For humanitarian reasons he felt it would not be appropriate to discuss his cryptography routines in this forum, an attitude I deeply respect. For more mundane reasons I felt it would be helpful to air some of the issues here. He has agreed to allow me to post some of the thoughts we shared. Here is an extract: ****************************** Patrick: "Nathan, I understand, respect, and appreciate your concerns about divulging the algorithm you use for encryption. I encourage you to read Phil Zimmerman's book about his development of PGP. It has an enlightening (and humorous) story about his own attempt to develop an encryption algorithm. I won't spoil the story for you, but after he showed it to experts at a conference on encryption he quickly came to the conclusion that it is more difficult than you might think to develop strong encryption. Most of the experts on encryption (I am certainly not one of them) believe that you can only classify an algorithm as having strong encryption if it has stood the scrutiny of published source and repeated challenge. PGP, SSL, SSH, and many other applications, have readily available source and invite attempts to challenge the algorithm. To the best of my knowledge there has been no known successful challenge to the current release of Network Associate's PGP encryption, and that's why it is the standard used by banks, insurance companies, invenstment houses, and other financial institutions. I have the highest regard for your technical expertise here in the midrange forum, and have learned a great deal from you. However, I believe you should not classify your solution as strong encryption without going through the process of having it tested in a public way. Weak or untested encryption is worse than no encryption. You may imagine your data is protected when it is not. This can lead to a false sense of security and unfortunate damage to your business." ****************************** Nathan's routine is certainly better than the one I cooked up some time ago. But I believe both of us created weak cryptography by today's standards. Thanks, Nathan, on a number of levels. Patrick ----- Original Message ----- From: "Patrick Townsend" <patownsend@patownsend.com> To: <midrange-l@midrange.com> Sent: Friday, October 12, 2001 7:43 AM Subject: Re: Encryption on the AS/400 > Nathan, > > Can you describe the strong encryption algorithm you are using? > > Patrick > ----- Original Message ----- > From: "Nathan M. Andelin" <nandelin@relational-data.com> > To: <midrange-l@midrange.com> > Sent: Thursday, October 11, 2001 9:08 AM > Subject: Re: Encryption on the AS/400 > > > > From: "Richard Bryant" <rbryant@quipp.com> > > > > > Does anyone know if there is software available > > > that will encrypt DB2 files on the AS/400? > > > > Yes. I have an ILE API that provides STRONG encryption based on a KEY > that > > you supply. If interested, please contact me privately. > > > > Nathan M. Andelin > > nandelin@relational-data.com > > www.relational-data.com > > > > > > _______________________________________________ > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing > list > > To post a message email: MIDRANGE-L@midrange.com > > To subscribe, unsubscribe, or change list options, > > visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l > > or email: MIDRANGE-L-request@midrange.com > > Before posting, please take a moment to review the archives > > at http://archive.midrange.com/midrange-l. > > > > _______________________________________________ > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list > To post a message email: MIDRANGE-L@midrange.com > To subscribe, unsubscribe, or change list options, > visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l > or email: MIDRANGE-L-request@midrange.com > Before posting, please take a moment to review the archives > at http://archive.midrange.com/midrange-l. >
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.