S/MIME or PGP/MIME?

[Paul Holman]

On Friday, December 7, 2001, at 04:13 AM, Marc Mutz wrote:
> If you encrypt messages you want nobody else than the recipients to be
> able to read them, no? Please tell me why you then want to send the
> same message encrypted to some and unencrypted to some others?

In some cases, you only have keys for some users and not for others.  If 
I'm sending a message to 6 people, and only have keys for 3, why should 
I be encouraged (or forced) to send it in the clear to all of them?

> Worse: This provides attackers with known plaintext, ie. they can
> compare the plaintext with the ciphertext. Generally, this has to be
> avoided.

A known plaintext attack is far less of a threat than not using crypto 
at all.  In PGP, does a known plaintext attack put the private key at 
risk?  As far as I know, that's not the case.  All you can really prove 
is that a given message went to somebody.

> KMail's new beta (out next week) will have opportunistic encryption for
> OpenPGP. We took the approach to tell the user that some recipients
> won't be able to read the message, but we cetainly don't send the same
> message encrypted and unencrypted.

I've heard great things about KMail and vow to check it out this week.   
I'm looking forward to seeing how you guys have integrated OpenPGP.

Thanks for the info,

pablos.
--
Paul Holman
Kadrevian Nonlinear Accelerator
pablos@kadrevis.com
415.420.3806