GPG Disk?

What is wrong with TrueCrypt? It's open source and works great?

Mica Mijatovic <bluenessgmx.net&gt; wrote: -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

— —
——— ·
— —
— — · ________________~~(_"._____."_)~~__________________
———
——— ·

I wonder if that would be technically hard, and how much, to make a
GPGDisk, an open source version of for instance the PGPDisk (following
the Zimmermann's open source trail).

How much work it would need, in terms of time, working in a `normal'
(not a feverish and similar, allegro furioso twitchissimo and so) tempo?

Would the number of coworkers lighten such a work?

If yes, and if I myself could help somehow in a such project, I would be
happy to do that.

- --
Mica
~~~ For personal mail please use my address as it is *exactly* given
in my "From|Reply To" field(s). ~~~
PGP public keys at: http://blueness.port5.com/pgpkeys/ |UPDATED|
http://tronogi.tripod.com/pgp/pgpkeys/ |KEYS! |
OSs: Windows 98 SE Micro Lite Professional IVa Enterprise Millennium
Windows XP(ee) Micro Lite Professional 1.6
Linuxes: Gentoo, Vector, Slackware, ZipSlack and Xandros
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6-svn-4217 <>o&lt;> tiger192 (Cygwin/MinGW32)

iQGxAwUBRO4z39BJaAFOulSGAQjTEgzgoyMegcqdomWA4QtgIz8RegLrgFa/3;3Bx
1Y/vSR1uagb9uyKL3YVeJgNq54BUu27GeT4nKQmq19iS6SmclaFultJSYlOr9GDR
XMOI7gJTJUNoTOMyNbSSl4GY9l0ga56H7t7LYn3jt&#43;VyKvOg/QmFajmhrydSXNqx
xhUIMMNFqe6dF4RnrhBe33kbn08J8jiRbyqxl/F/m4hJdV6wgcpY7jy1F46rpVP2
U79Dr9LNrRYQUIZ0f354DmJu9KUIwHs3H1XtykvMhtUtaLb/Ca8TCEZZw7RAk0/I
DnRq8YACUYrLuPOM80vqhzjhZErzgjGrpmkdNcVOUnn5Jn2nAFPu5B3zN9A9ZsFQ
FOVHplFXtMgJYrCn3lCYMn2TFB5580dKtMobok4deF/93UqR5TRwV6ZNKbsnvjJW
tGulVsFpVCtS4UP0w846VWGO04Z56wYbo3fSETsSPbCypdQNNVP8uZAHGmudL4EV
vCxY25TxZM/GlghEytvjSactVeAO+;VcgZO4f/c/6fiMFZ9c2v3hEQw6TTIF0zZHC
FnZihA==
=DhEx
-----END PGP SIGNATURE-----

__________________________________________________________
Archives: http://groups.yahoo.com/group/PGP-Basics/messages
OT List: http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe: mailto:PGP-Basics-OT-subscribeyahoogroups.com
Yahoo! Groups Links

[Non-text portions of this message have been removed]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Tracy D. Bossong wrote:
&gt; What is wrong with TrueCrypt? It's open source and works great?

No remarks on TrueCrypt. With respect to a GPGDisk, it's a dead issue.

The GnuPG crew's primary objective is to support the fully open-sourced
Unices. Proprietary Unices come a distant second. Win32 support comes
an even more distant third.

Under the open-source Unices, encrypted filesystems--things analogous to
PGPDisk--are widespread and commonly available. Thus, if the GnuPG
crew's primary mission is to support open-source Unices, why should they
reinvent the wheel?

>> I wonder if that would be technically hard, and how much, to make a
>>; GPGDisk, an open source version of for instance the PGPDisk
>> (following the Zimmermann's open source trail).

Repeat after me: _there is no open source for PGP._ [*] Anyone who
studies the PGP source in order to learn crypto programming is opening
the door to a huge set of lawsuits. Anyone who creates their own
product using lessons learned from studying PGP is opening the door to a
huge set of lawsuits. Anyone who... etcetera. This is a huge can of
worms. It's best avoided.

[*] At least, not any you'd trust or use. PGP 2.3 was open-sourced.
Supposedly, 2.6xui was GPLed, but this is not possible as the original
2.6 code did not allow for relicensing.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQEcBAEBCgAGBQJE7kRdAAoJELcA9IL&#43;r4EJEU4IANLYP3X/eU0vjjPF9IAVPhSS
1KJEFsEJel5wbav1vRomPVqmgelryIQbWEDlTcTK4Y2MU4bTK4wOSQOvxm8LnJyN
l1YaQ8punktgiVOOle/OwUGp0uIfrGC5XssYmhBzgkDiDR3xwuTVz2ZPBx8KFiPd
bVI2eym2fk6w0y/MWj6eBAKTgg01wS6QkNTBXHkGG5H/h2bY9TnpwfIhlpnusCBd
N2VqkVavX3fSG91MK+50/HKXuvbMtfsTxnMwqoojMuKp7DOnNxyFpHlTcQylIia4
309QK6rq8+LsD2AahIH6VTYGv2svtzii4bTdpSevjB8RJJgzkQA2ADThps1u2Mw=
=rOmE
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> -----Original Message-----
> From: PGP-Basicsyahoogroups.com
&gt; [mailto:PGP-Basicsyahoogroups.com] On Behalf Of Robert J. Hansen
&gt; Sent: Thursday, August 24, 2006 5:29 PM
> To: PGP-Basicsyahoogroups.com
&gt; Subject: Re: GPG Disk?
>;
> Tracy D. Bossong wrote:
&gt; > What is wrong with TrueCrypt? It's open source and works great?
&gt;
> No remarks on TrueCrypt. With respect to a GPGDisk, it's a
> dead issue.
&gt;
> The GnuPG crew's primary objective is to support the fully
>; open-sourced Unices. Proprietary Unices come a distant
&gt; second. Win32 support comes an even more distant third.
&gt;
> Under the open-source Unices, encrypted filesystems--things
> analogous to PGPDisk--are widespread and commonly available.
> Thus, if the GnuPG crew's primary mission is to support
&gt; open-source Unices, why should they reinvent the wheel?

What is a Unices?

Also, TrueCrypt doesn't use GPG or PGP keys does it? If it does, then
perhaps someone likes the quality of the coding done in GPG and would like
the same quality in a product. There's nothing wrong with wanting to open
up to assist on a project to make a new bit of software.

> >> I wonder if that would be technically hard, and how much,
>; to make a
> >> GPGDisk, an open source version of for instance the PGPDisk
&gt; >> (following the Zimmermann's open source trail).
&gt;
> Repeat after me: _there is no open source for PGP._ [*]
> Anyone who studies the PGP source in order to learn crypto
&gt; programming is opening the door to a huge set of lawsuits.
> Anyone who creates their own product using lessons learned
&gt; from studying PGP is opening the door to a huge set of
> lawsuits. Anyone who... etcetera. This is a huge can of
> worms. It's best avoided.

I think that sounds... Harsh to say the least, not that you'd trust? I
think its safe to say that YOU personally wouldn't trust it. Are you an
authority on cryptography? Do you have concrete evidence that any source
released for PGP past v2.3 (having read your comment below) has a back door
or other such issue? I think we should be a little more open about people
deciding their own levels of trust and what they are comfortable with.

Myself, with all the ways a potential invader could get into my system
(given physical security, software that I am not willing to give up, and
ammount of time I have to reasonably secure it via software) I am much more
worried about more mundane methods of getting my information or my secrets.
My security measures are meant to stop people who would not have access to
security holes that aren't commonly known. Antivirus, firewall, behind a
NAT router. Anyone who's going to get into my system has more than enough
methods to capture my passwords and such without resorting to a possibly non
existant hole, bug, or purposful back door in the PGP code. Those with
access to the, I'll call them non standard methods of getting into my system
could likely just arrest me and compel me to give up a password (if they
cared that much to begin with). Additionally, should anyone with that kind
of knowledge not wish to go through that trouble or visibility (again if
they even cared) they could simply break in and install a physical keylogger
and come back in a few days. Again, no need to exploit a potentially
unknown hole in PGP.

That is also assuming that the Office of Homeland Security can't already
slice through the crypto like butter at will and just hasn't told anyone -
if you want to be really paranoid. Once again, and assuming my information
is worth enough to them to go through that much effort.

> [*] At least, not any you'd trust or use. PGP 2.3 was open-sourced.
> Supposedly, 2.6xui was GPLed, but this is not possible as the original
> 2.6 code did not allow for relicensing.

If the creator of the software, Phil Z or whoever owns the copyright to the
software did it, could they not relicense it?

Additionally... What does it being GPL have to do with security? If you
can read the source code - whatever the license on it - you could (in
theory) find holes or lack of holes in the code. Or does it not being under
GPL somehow make flaws or holes less visible?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32) - GPGrelay v0.959

iD8DBQFE7sOnStZoE1nza5gRCDH/AJ0ZosiDINJWdd2yO4LUNiWKnYiACwCeLZ6H
XeegkVHZqyXZcaErJrdxroU=
=fyDu
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> -----Original Message-----
> From: PGP-Basicsyahoogroups.com
&gt; [mailto:PGP-Basicsyahoogroups.com] On Behalf Of Robert J. Hansen
&gt; Sent: Thursday, August 24, 2006 5:29 PM
> To: PGP-Basicsyahoogroups.com
&gt; Subject: Re: GPG Disk?
>;
> Tracy D. Bossong wrote:
&gt; > What is wrong with TrueCrypt? It's open source and works great?
&gt;
> No remarks on TrueCrypt. With respect to a GPGDisk, it's a
> dead issue.
&gt;
> The GnuPG crew's primary objective is to support the fully
>; open-sourced Unices. Proprietary Unices come a distant
&gt; second. Win32 support comes an even more distant third.
&gt;
> Under the open-source Unices, encrypted filesystems--things
> analogous to PGPDisk--are widespread and commonly available.
> Thus, if the GnuPG crew's primary mission is to support
&gt; open-source Unices, why should they reinvent the wheel?

What is a Unices?

Also, TrueCrypt doesn't use GPG or PGP keys does it? If it does, then
perhaps someone likes the quality of the coding done in GPG and would like
the same quality in a product. There's nothing wrong with wanting to open
up to assist on a project to make a new bit of software.

> >> I wonder if that would be technically hard, and how much,
>; to make a
> >> GPGDisk, an open source version of for instance the PGPDisk
&gt; >> (following the Zimmermann's open source trail).
&gt;
> Repeat after me: _there is no open source for PGP._ [*]
> Anyone who studies the PGP source in order to learn crypto
&gt; programming is opening the door to a huge set of lawsuits.
> Anyone who creates their own product using lessons learned
&gt; from studying PGP is opening the door to a huge set of
> lawsuits. Anyone who... etcetera. This is a huge can of
> worms. It's best avoided.

I think that sounds... Harsh to say the least, not that you'd trust? I
think its safe to say that YOU personally wouldn't trust it. Are you an
authority on cryptography? Do you have concrete evidence that any source
released for PGP past v2.3 (having read your comment below) has a back door
or other such issue? I think we should be a little more open about people
deciding their own levels of trust and what they are comfortable with.

Myself, with all the ways a potential invader could get into my system
(given physical security, software that I am not willing to give up, and
ammount of time I have to reasonably secure it via software) I am much more
worried about more mundane methods of getting my information or my secrets.
My security measures are meant to stop people who would not have access to
security holes that aren't commonly known. Antivirus, firewall, behind a
NAT router. Anyone who's going to get into my system has more than enough
methods to capture my passwords and such without resorting to a possibly non
existant hole, bug, or purposful back door in the PGP code. Those with
access to the, I'll call them non standard methods of getting into my system
could likely just arrest me and compel me to give up a password (if they
cared that much to begin with). Additionally, should anyone with that kind
of knowledge not wish to go through that trouble or visibility (again if
they even cared) they could simply break in and install a physical keylogger
and come back in a few days. Again, no need to exploit a potentially
unknown hole in PGP.

That is also assuming that the Office of Homeland Security can't already
slice through the crypto like butter at will and just hasn't told anyone -
if you want to be really paranoid. Once again, and assuming my information
is worth enough to them to go through that much effort.

> [*] At least, not any you'd trust or use. PGP 2.3 was open-sourced.
> Supposedly, 2.6xui was GPLed, but this is not possible as the original
> 2.6 code did not allow for relicensing.

If the creator of the software, Phil Z or whoever owns the copyright to the
software did it, could they not relicense it?

Additionally... What does it being GPL have to do with security? If you
can read the source code - whatever the license on it - you could (in
theory) find holes or lack of holes in the code. Or does it not being under
GPL somehow make flaws or holes less visible?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32) - GPGrelay v0.959

iD8DBQFE7sOnStZoE1nza5gRCDH/AJ0ZosiDINJWdd2yO4LUNiWKnYiACwCeLZ6H
XeegkVHZqyXZcaErJrdxroU=
=fyDu
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

———
——— ·
——— ·
———
— — · Was another beautiful day, 06-08-25, at 17:06:09 -0700 (PDT),
——— · when Tracy D. Bossong wrote:

> What is wrong with TrueCrypt? It's open source and works great?

Tracy, I didn't refer to any other disk/volume encryption software here
(since it {w|c}ould lead to a longish random discussions of questionable
quality and not much useful and effective), but was, and still am,
interested in simple direct estimations (of real experts of course,
meaning the competent people who are practically involved in such works)
as to the time needed and complexity of such a possible work. Just to
have it in my mind in a case of possible action.

______________
It is so because I am interested in action rather than
in idle and incessant talk producing no other effects
but of a kitschy pretentious quasi-expert plays given
for spectators in a dinner theater of a local country
club after stale bean and inhalation of a cheap glue. (-:

***

As to the TrueCrypt anyway, I am not much focused on it at the moment so
I couldn't list reasons pro and contra, but it is surely much better, in
many ways, than a PGPDisk.

With regards to its "openness", it's not the originally and fully open
source, as it is defined by GPL and Free Software Foundation, for
instance.

The part "(following the Zimmermann's open source trail)&quot; relates to
Zimmermann's basic definition of Pretty Good Privacy, as it is given in
his "Why I Wrote PGP" rather than a literal utilization of his source
codes.

It is to expect that style of coding changes, but the conception, if is
good, even if is not immaculate, remains.

- --
Mica
~~~ For personal mail please use my address as it is *exactly* given
in my "From|Reply To" field(s). ~~~
PGP public keys at: http://blueness.port5.com/pgpkeys/
http://tronogi.tripod.com/pgp/pgpkeys/
OSs: Windows 98 SE Micro Lite Professional IVa Enterprise Millennium
Windows XP(ee) Micro Lite Professional 1.6
Linuxes: Gentoo, Vector, Slackware, ZipSlack and Xandros
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6-svn-4217 <>o&lt;> tiger192 (Cygwin/MinGW32)

iQEVAwUBRPBen7SpHvHEUtv8AQhR9gf/SrOuWCe7PcbCC2ILFpd0/LlgL/90VNDG
NcdxTWR7XPE1R52/VymvIy8B4ZPH8SPA8TSWhQX5ymvj+A/JoJZrJWZd0pPFE4Gz
GenMDp0/Z0bhML3ayCPVzUh8QmLIgS2ZYmqDCva4bpwgfm3VVGk8FaJ0aU5+;xOg/
kCbhYl7IhOKEmawCqjbQ/scjo6M0VwrPpf1FrznyWGWqz+OZQP7YKwf6L0ZC70pD
AFzS8dVV+EZ7t7WZ/8mmRi7KCtvXJ020snHdOgtjzlwz2++rq4AAfLJ5AI1C/hGf
6Abq4YJBLRFqCABG4S+ISbp2psJDaSZapPqoc+fKMBCuF07lIM3NNQ==
=x/dt
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Saturday, August 26, 2006, 12:47:46 PM, Ian Scott wrote in part:

&gt;> For Robert particularly: try please to be decent and polite in
>&gt; addressing others,

IS> You wrote this 11.3 KB message in response to Robert's "Repeat after me????&quot;

IS>; I enjoy the way Robert communicates. Of course, "enjoy" is my projection.
IS> Robert is always precise and it is not his fault that others might project
IS> upon his words and see "behaviour" in their own minds.

I could not have said it better, and although I despise 'me too' post,
I've just realized that on very rare occasion, my making one may be
appropriate.

- --
Cheers,

Ron.

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1 (C) 1997-1999 Network Associates, Inc. and its affiliated companies.
Comment: Public key: http://pankfloyd.com

iQA/AwUBRPCnypHUc2Bg+6SFEQMhrwCgwtdNf94JQjr80pSpQjwXI6P2KrkAn1SQ
TH3lksnzkvKTkczUNmUklJ7e
=0xZY
-----END PGP SIGNATURE-----