Re: PGP scripting...

• Previous message: Giorgio Zoppi (deneb): "Re: PGP scripting..."
• In reply to: Andrew MacKenzie: "PGP scripting..."
• Next in thread: lsi: "Re: PGP scripting..."
• Reply: lsi: "Re: PGP scripting..."
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Tue, 7 Jan 2003 12:53:59 -0600 (CST)
From: Ed Carp <erc@pobox.com>
To: Andrew MacKenzie <edespot.com!andy@adsl-61-76-31.pns.bellsouth.net>

On Tue, 7 Jan 2003, Andrew MacKenzie wrote:

> My question therefore is: is all this worth the trouble? In order to use
> PGP with scripts (or even Java code), the scripts need access to both the
> private key and pass phrase (which are stored locally in files). If the
> system were compromised would any of this help? Is there a better way I
> could do this than what I am already doing? This is somewhat academic for
> me at this point, as my client is inflexible on this point and code has
> been written, but I'd be interested in hearing your opinions on this
> subject.

Be extremely careful when using PGP with any scripting language,
especially when dealing with the private key. Almost all scripting
languages were not designed with security in mind and therefore do a lousy
job of it. If the system were compromised as root, then the attacker has
the keys to the kingdom, so to speak.

I worked on a project once for a large security concern. One way we
came up with to do decryption is to copy the encrypted file via UUCP (the
computers were connected via serial port) to the decryption server, which
would decrypt the message, then send it back via UUCP. Our exposure was
only for the decrypted message, but the keys couldn't be compromised
nearly as easily. The server where the encrypted file resided was of
necessity exposed to the rest of the company, while the server where the
public and private keys were was on the other machine. Using UUCP enabled
us to very tightly control the interaction between the two machines,
without having the risk associated with networking the two machines
together.

Hope this helps.

• Next message: Alex Russell: "Re: PGP scripting..."
• Previous message: Giorgio Zoppi (deneb): "Re: PGP scripting..."
• In reply to: Andrew MacKenzie: "PGP scripting..."
• Next in thread: lsi: "Re: PGP scripting..."
• Reply: lsi: "Re: PGP scripting..."
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]