comparison gpg:pgp6.5.1

Simpson, Sam
Mon, 17 Jan 2000 14:49:07 +0000

An interesting e-mail....I'm also looking at comparing the security of GPG
and PGP...

> -----Original Message-----
> From: Mark Goldstein []
> Sent: 17 January 2000 04:53
> To:
> Subject: comparison gpg:pgp6.5.1
> Questions from a hopeful convert:
> 1. How do the random number generators compare?
My understanding is that GPG relies on the OS provided RNG whereas PGP offers it's own primitives. This is ok if you trust the construction of the /dev/random devices but on operating systems I wouldn't trust as far as I could throw (Winxxxx) then the PGP solution is probably preferable. Have a look at for details of how RNGs are employed in GPG.
> 2. Are the prime numbers used in key generation calculated
> or is there a
> prepared list (i.e. the quick key gen option in NAI's pgp)?
GPG doesn't include "canned primes" for ElGamal / DSA keys. This is good IMHO (though I can imagine situations where keygen would be a bonus...). I guess the best solution is to offer the option of employing canned primes but by default turn this off.
> 3. It's my understanding there are no temp/swap etc. file
> generation to leave
> an unaccounted plaintext. Is this true, and how?
Pass. I've still only given GPG source code a cursory glance :(
> 4. Is there a wipe option? If not, how does one assuredly eliminate a
> plaintext file. If a wipe is present, how many overwrites
> are performed?
Afaik no wipe is present. For half-secure OSs I would expect this function to be included as a standard function (C2 criteria talks about wiping before reuse etc...). Not sure if Linux wipes before re-use.... Regards, Sam Simpson Communications Analyst -- for ScramDisk hard-drive encryption & Delphi Crypto Components. PGP Keys available at the same site.