comparison gpg:pgp6.5.1

[sungod]

On Mon, Jan 17, 2000 at 02:49:07PM +0000, Simpson, Sam (s.simpson@mia.co.uk) wrote:
> An interesting e-mail....I'm also looking at comparing the security of GPG
> and PGP...
> > From: Mark Goldstein [mailto:mgoldstein@austin.rr.com]
> > Sent: 17 January 2000 04:53
> > To: s.simpson@mia.co.uk
> 
> > 3.  It's my understanding there are no temp/swap etc. file 
> > generation to leave
> > an unaccounted plaintext.  Is this true, and how?
> 
> Pass.  I've still only given GPG source code a cursory glance :(

GPG is best used installed to run with superuser access. This gives it the
ability to request a portion of memory which will not be paged to disk by the
operating system. If you DON'T set it to run as superuser, it will give an
error telling you that it is using unsecure memory.

> > 4.  Is there a wipe option? If not, how does one assuredly eliminate a
> > plaintext file.  If a wipe is present, how many overwrites 
> > are performed?
> 
> Afaik no wipe is present.  For half-secure OSs I would expect this function
> to be included as a standard function (C2 criteria talks about wiping before
> reuse etc...).  Not sure if Linux wipes before re-use....

I don't think there's a wipe function either, but this is A Good Thing(TM).
True to the Unix design philosophy, GPG is intended to encrypt and decrypt
files, and things like triple-rewrite-with-random-data-and-wipe-clean-with-
small-tactical-nuclear-weapons are better left to outboard utilities that
can dedicate themselves to doing a better job without being considered "bloat."

-- 

Everything on television is fake.
----------------------------------------------------------------------------
sungod@atdot.org