|
Cryptome DVDs. Donate
$25 for two DVDs of the Cryptome collection of 47,000 files from June 1996
to January 2009 (~6.9 GB). Click Paypal or mail check/MO made out to John
Young, 251 West 89th Street, New York, NY 10024. The collection includes
all files of cryptome.org, cryptome.info, jya.com, cartome.org,
eyeball-series.org and iraq-kill-maim.org, and
23,100 (updated)
pages of counter-intelligence dossiers declassified by the US Army Information
and Security Command, dating from 1945 to 1985.The DVDs will be sent anywhere
worldwide without extra cost. |
|
4 June 1999
Date: Fri, 04 Jun 1999 10:45:21 +0200
From: Michel Bouissou <michel_bouissou@wanadoo.fr>
To: jya@pipeline.com
CC: prz@acm.org
Subject: *** Message from Phil Zimmermann ***
Hello,
Please find below a message from Philip R. Zimmermann.
Please read my footnote if you have any problem with Phil's signature
verification.
The following message may be widely distributed.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I'd like to address the rumors concerning the cryptographic integrity of
PGP, including recent versions made by Network Associates, as well as
recent freeware versions built and released by Stale Schumacher on his
website in Norway at http://www.pgpi.org. These rumors allege that these
versions of PGP contain back doors for the US Government to access the
plaintext messages or keys. I do not know how such sensationalist
conspiracy theories get started, but they seem to come from people who
believe that The X-Files is a documentary.
Let me assure everyone that all versions of PGP that are released from
Network Associates have the same cryptographic integrity as all previous
versions of PGP that were released since the old days before I started
my company, PGP Inc. In fact, no version of PGP in which I have been
personally involved has ever had any back doors or any other mechanism
to intentionally weaken PGP. That includes versions released by MIT,
PGP Inc, Network Associates, or Stale Schumacher.
After all the hardship and legal persecution that I endured to bring PGP
to the world, I find it surprising and offensive that anyone would think
that I would quietly stand by and tolerate any compromise in the
cryptographic interity of PGP.
When Network Associates acquired my company in December 1997, they also
acquired the same engineering team that we had put together at PGP Inc,
a team dedicated to the same principles of personal privacy that led me
to create PGP. This team is still working on PGP today, and will continue
to help me protect the integrity of PGP. Network Associates has not
shown the slightest interest in compromising the integrity of PGP. They
recognise that it would not be in their business interests to do so.
We have always published the source code for every version of PGP for
peer review purposes, and Network Associates has carried on that tradition.
Anyone may download the source code for PGP from www.pgpi.org and examine
it for any back doors. Stale Schumacher, an independent PGP activist
who is not an employee of Network Associates, has done all the builds
since PGP 5.0i for the freeware versions of PGP in Europe. I have known
Stale for several years and I know that he is committed to the same
political principles of privacy as I am. I feel confident that Stale
would never compromise the integrity of PGP in the versions that he
builds for distribution on his site. Nonetheless, anyone who worries
if the binary executables for PGP are trustworthy may compile the code
themselves and rebuild the binaries for their own personal use, as long
as they do not redistribute such rebuilt binaries for others to use.
-- Philip Zimmermann
http://www.pgp.com/phil
3 June 1999
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1b40
iQA/AwUBN1bDM2PLaR3669X8EQLXSACg4Z5+//BgNg4OjeKDugnQ0wmWbXEAoPsl
v4z0is5aXeLPf0cOJSqnyX9Q
=QOqg
-----END PGP SIGNATURE-----
Signature verification:
I first encountered a problem in checking Phil's signature from within
Outlook Express: Phil's signature displayed as "bad".
The reason is that Phil' signature line begins with " -- Philip..." and
Outlook Express doesn't seem to like the leading space. When copying the
message to the clipboard for checking the signature, Outlook Express
removes this space, causing the verification process to fail.
Weirdly enough, if you save the message as a .TXT file using Outlook
Express, then the space is correctly reproduced and the sig check on the
obtained text file succeeds!
If you happen to have the same problem with your mail/news reader, Please
save this document as a text file, and check that there is ONE space at the
beginning of Phil's signature line. Correct manually if necessary. Then,
the signature check should be OK.
Michel Bouissou <michel_bouissou@wanadoo.fr> DH/DSS ID 0x80DBBD8F