Subject: RE: Associating symmetric algorithms with a public key

From: "Trevor Freeman (Exchange)" <[email-masked]>
Date: Tue, 16 Nov 1999 10:56:34 -0800

This is a hint as to what to use, nothing more. 
If I have you public key and want to encrypt a file, I could guess what
symmetric algorithms to use. It does not hold that if I have publicise the
set of symmetric algorithms on my workstations, every public encryption key
I have in a certificate would successfully decrypt data with any of the
symmetric algorithms.  The key exchange world complete successfully, and you
client would know the session key, but it is not guaranteed that that code
with the session key would have access to every symmetric algorithms
implementation on you workstation.

-----Original Message-----
From: Paul Koning [mailto:[email-masked]]
Sent: Tuesday, November 16, 1999 10:20 AM
To: Trevor Freeman (Exchange)
Cc: [email-masked]
Subject: Re: Associating symmetric algorithms with a public key

>>>>> "Exchange" == Exchange  <Trevor> writes:

 Exchange> There are a number of applications which need a hint as to
 Exchange> the set of symmetric algorithms which can be used with a
 Exchange> public key from a certificate for encrypting data with
 Exchange> asynchronous applications. 

I'm puzzled by this.  What connection is there between a public key
and a set of supported, or permitted, symmetric algorithms?  I just
don't see the relationship.

	paul

---

From: Paul Koning <[email-masked]>
Date: Tue, 16 Nov 1999 16:35:04 -0500

>>>>> Trevor writes:

 Trevor> This is a hint as to what to use, nothing more.

 Trevor> If I have you public key and want to encrypt a file, I
 Trevor> could guess what symmetric algorithms to use. It does not
 Trevor> hold that if I have publicise the set of symmetric
 Trevor> algorithms on my workstations, every public encryption key
 Trevor> I have in a certificate would successfully decrypt data
 Trevor> with any of the symmetric algorithms.  The key exchange
 Trevor> world complete successfully, and you client would know the
 Trevor> session key, but it is not guaranteed that that code with
 Trevor> the session key would have access to every symmetric
 Trevor> algorithms implementation on you workstation.

Now I get it even less, I think.

So if a cert said "DES" you could still use Blowfish to encrypt my
files?  I could still use CAST to protect my IPSEC sessions?

If it's a "hint" that sounds like a user preference or application
interface default item.  You can put those things in your application
registry or in configuration files or user setup scripts or stuff like 
that, but it definitely doesn't belong in a cert.

	paul