PGP source code

[Richard Clayton]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In article <200109041158.XAA110130@ruru.cs.auckland.ac.nz>, Peter
Gutmann <pgut001@cs.auckland.ac.nz> writes

>Richard Clayton <richard@demon.net> writes:
>
>>There's a little more in this October 2000 BYTE article:
>>
>>        http://www.byte.com/documents/s=479/BYT20001016S0006/
>>
>>Although BYTE talks about "checksums", the microcode is signed (I am told on
>>excellent authority [though admittedly, my memory may not be as good as the
>>authority!]) by a 2048 bit RSA key...
>
>Just thinking out loud here, but this seems rather unlikely.  

My source sounded very sincere

[those nice people from Chatham House will be along to beat me up if I
go very much further than that]

>Implementing an
>RSA library in the microcode would be an incredible amount of work and waste of
>microcode space, and there wouldn't be any real advantage over just using a
>MAC, given that the only way to get at the MAC key would require a nontrivial
>amount of reverse-engineering effort.

You may recall the unique number in some Pentiums (the PR fuss meant
that the idea is not being resurrected any time soon). This was a proof
of concept (particularly of the manufacturing complexities) along a path
that led to having a public/private key pair in there...  and the RSA
microcode can be used for that as well.....

There are many companies that would like to ship software that only ran
on your machine and no other. Reading MAC addresses from Ethernet cards
is as nothing to encrypting the binary for your particular CPU [or four]

- -- 
richard @ highwayman . com                       "Nothing seems the same
                          Still you never see the change from day to day
                                And no-one notices the customs slip away"

-----BEGIN PGP SIGNATURE-----
Version: PGPsdk version 1.7.1

iQA/AwUBO5TKXhfnRQV/feRLEQIDYwCdE9gg5PEC4pWi2I6jZsx1/chymcYAoNhx
F1dr4EoXlR46DDkasI31Vpiu
=NG2b
-----END PGP SIGNATURE-----