IBE and PGP

Identity-based encryption (IBE) was first proposed by Adi Shamir over 25 years ago, developed by Dan Boneh and Matt Franklin in one scheme, and Clifford Cocks in another. If these names don't mean much to you, Adi Shamir is the S in RSA (Rivest and Adleman being the R and A). Dan Boneh founded Ingrian Networks and Voltage Security, as well as advising for many other important crypto companies on the West Coast. Clifford Cocks is a Brit who invented the RSA algorithm before Rivest, Shamir and Adleman at GCHQ in the UK, but wasn't allowed to divulge anything about it because it was owned by the government. In short, they are the biggest names you can get in cryptography.

So, you'd think that IBE was a bloody good idea then. Well, yes, it's a cracking idea... and as an idea, it will remain cracking. As a practical implementation of encryption, it's nothing short of impossible however. Trust me, I've tried. There are 2 products you can do this with currently, Voltage and Trend Micro.

I've been assured that Voltage's approach to database encryption is a good one (by Voltage), and from what I know about IBE, I can imagine that it might work, but they don't push much on email (or didn't when we last spoke - I see they are talking about ING Canada on their website now). Trend Micro of course bought Identum, the email encryption company out of Bristol University. Basically a student project which ended up being bought by a company which thought they were getting a cutting edge, fully developed product.

I spent a long time trying to install this product, and never got it working how I wanted it to. There are just too many mandatory requirements for it to be practical. You may think I'm saying this because I'm more interested in PGP, but actually, this is the reason WHY I'm backing PGP.

Until I came across Trend I had kind of ignored email encryption - email is an inherently insecure method of sending information, why encrypt it? Choose another method if you want to exchange or send information. However, I've always had faith in people's ability to learn new things, and apparently that is misplaced. People in finance and law are too busy or too helpless to use anything other than email apparently. The smartest and richest people in our country are simply too stupid to learn how an FTP server works, so secure mail we must.

That was basically how Trend presented it, and it apparently started to get some traction, so much so that I got to work on a secure email project recently in one of these places. It didn't work, and I've heard of others where it didn't. I never heard of one which did. At this point I took matters into my own hands and found PGP through some friends of mine.

Why isn't PGP bigger? Why isn't it everywhere already? Well, simply because they haven't pushed it onto everyone, but let people pick it up as they need it. I'd love to show it to everyone in the financial industry in the UK and let them see just how good it is for encrypting mail. Many of them have it already, for Whole Disk or File Encryption, some already have a Universal Server holding their keys, and a policy server holding policies. Adding mail encryption is barely any work, or cost, in these environments.