Re: Moving files from lisp/gnus/ to lisp/net/?

[Ted Zlatanov]

On Mon, 01 Nov 2004, address@hidden wrote:

> I understand the problem.  One solution is to simply not use
> encryption methods that doesn't provide integrity?  Then the
> decryption process would know if the password worked or not.

We could do that, but I think it would be a loss to the users.

> I believe that, in general, encryption mechanisms that do not offer
> integrity protection are questionable.  The XOR key derivation from
> password seem a bit fragile, too.  On the other hand, I realize that
> only using GnuPG may create more work for the user.

There are many reasons why the XOR cipher is desirable - not the least
of which is that it depends on nothing and is very fast.  Encryption
is just a deterrent, like any other kind of data security, so it makes
sense to have something trivial in addition to the real methods like
GnuPG.

You are right, however, that GnuPG can indicate that decryption
failed.  So maybe some ciphers should have the property :fail-aware
and the code will do the passwords accordingly.  Do you think this is
the right approach?

Ted