RE: Encrypted email versus HTTPS

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

> 1) The encrypted .zip seems the simplest solution and in the interest of
> expediency we might go with something like that - assuming that is 'secure'
> enough to suit our client.

Unless something has changed since I last looked into it, the encryption 
on a ZIP file is relatively weak. You can break it in a day or two with a 
fast PC, and there are (or at least were) free utilities on the Internet 
to do so.

Just wanted to make you aware of that so you can make an informed choice.


> 2) We're using 'jar' in a CLLE to compress the outbound files and as far as
> I can tell it does not support encryption. Are you aware of any iSeries
> utilities that support file encryption?

I've done this using Info-ZIP, which is a free zip program that does 
support encryption. I'm running mine in PASE, and I imagine that that's 
the only way to make it work, though I haven't put too much effort into 
trying to make it run natively.

Things run so well in PASE, I don't know why you'd want to bother with a 
native port.  And PASE is free and included on the OS/400 CDs (but 
installed separately) in V5R2.

There's an article about setting up PASE w/Info-Zip on the iSeries Network 
Web site. You can read it at the following link if you've got a membership 
with the iSeries Network:
http://www.iseriesnetwork.com/article.cfm?id=17815


> I've Googled for 'tar iseries' and 'gzip iseries' and they all lead to 
> PASE, something I'm really not comfortable with yet.

TAR is a Unix thing, so it's natural that it'd be in PASE or QShell. 
Indeed, both of them (PASE and QShell) come with a TAR utility. TAR 
doesn't usually include encryption, though...

The "Unix way" is usually to have lots of programs, each that performs a 
separate task, so that they can be combined to be as versatile as 
possible.  TAR's purpose so to combine many files into an archive.  GZIP 
compresses things. Other tools, such as 'bdes' can be used to perform 
encryption.

When you combine these things, you get them all...  a compressed, 
encrypted, archive file.

AFIAK, the iSeries does not support bdes. I don't know if there's an 
encryption tool designed for QShell, but I guess there might be. 
At any rate, Windows users might have problems decrypting and extracting 
an encrypted TAR... If you know that all of your users are Unix, then it 
shouldn't be a problem.

See, this is why HTTPS is so much simpler! The encryption is in the 
transport, not the file itself. Every web browser supports SSL. Just get 
them to download the file and you're done.


> I remember seeing an RPG-based 'zip' utility, probably in one of the 
> iSeries newsletters, last year but cannot lay hands on it now...

Hmmm...  I don't think I'd want to try to reinvent the wheel by writing 
PKZIP in RPG.

If you want a commercial solution, it appears that PKWARE does make PKZIP 
for the iSeries:
http://www.pkware.com/support/faq/iseries/

Patrick Townsend supports both encryption and compression packages:
http://www.patownsend.com

Trailblazer Systems has some PGP solutions:
http://www.trailblazersystems.com

I've never tried any of the above solutions, so I can't tell you if any 
are good or bad. I use PASE for pkzip stuff, and SSL when I want 
encryption.