Cipher v public key.

[David Gray]

Hi, 

Yes I've had a few people tell me that the version I'm using needs 
upgrading so I'm going to download the latest version from HP. 

I would like the exchange of encrypted data to be using asymmetric keys and
this 
is the route I'm trying to steer the customer.  They have said they want
AES256 as 
the encryption algo but are open to advice on symmetric v asymmetric.  

A concern they have expressed is that if we use pubkey then the secret key
needs 
to be generated by me. they don't seem too keen on this as they would like
to 
have control over this and have the option to change the key twice a year.  

As I understand it this then means we have to look at secure options 
for them distributing the secret key to me.  They are looking into a
commerical method 
for key delivery right now. 


Whilst typing this message the download link has arrived for GPG from HP.
The version they 
host is...

GNUPG-1_2_3_AXP.EXE    !     for Alpha 
GNUPG-1_2_3_VAX.EXE    !     for VAX 

Anyone know if the later versions are available for VMS? 

Thanks 
Dave 

     




-----Original Message-----
From: Robert J. Hansen [mailto:rjh at sixdemonbag.org] 
Sent: 26 May 2006 17:35
To: David Gray
Cc: 'gnupg-users at gnupg.org'
Subject: Re: Cipher v public key.


David Gray wrote:
> $ gpg --version
> gpg (GnuPG) 1.2.3

This is an old version.  You should probably consider upgrading to 1.4.3.

> AES256 is listed as a cipher but not a public key?  What is the
> The difference?  I was hoping to use asymmetric keys with me 
> Giving the public key to the customer.  As mentioned before this all 
> Works fine but I'm not sure which alogorithm I'm using when encrypting. 

Asymmetric and symmetric algorithms are fundamentally different.  They work
in different ways and are used for different purposes.  For that reason, the
asymmetric algorithms ("pubkey") are listed separately from symmetric
algorithms ("cipher").

The terminology is, admittedly, a bit confusing.

> So after all that my question really is, how do I set the alogorithm 
> to AES256 in windows so I can test decrypts on VMS?

First decide the kind of encryption you want.  AES256 just says "I want
AES256 to be part of the solution"; it doesn't declare what the solution is
going to be.

AES256 can be used as part of RFC2440 messages (OpenPGP).  AES256 can be
used as part of GnuPG symmetrically-encrypted messages, with no public keys
involved.  Or AES256 can be used as a raw algorithm in any of many different
modes.