Re: netrc.el now supports encoded files

[Ted Zlatanov <tzz@lifelogs.com>]

On Tue, 06 Jan 2004, jas@extundo.com wrote:

> Or a crypt+++.el.  It is a generally useful feature, so perhaps it
> is worth the effort to separate it from Gnus.

I saw crypt++.el, and it goes too far in my opinion.  There's just too
much work to use it, and it interferes with file hooks.  I'd rather
provide a simple interface to symmetric decoding of a file into a
buffer and decoding back, using external utilities or extensible
ciphers.  I'll inquire on the emacs-devel list.

> The AES specification limit the key lengths and block lengths, if
> you need arbitrary data lengths or password-to-key derivation, you
> must invent your own -- or preferably, use something prepackaged,
> like CMS or OpenPGP.

OK, so we're back to external utilities...  Maybe I'll prepend a
number to the string, so I know the length of the data, and then pad
it to the multiple that rijndael.el likes.  I'd really like a
built-in cipher so we don't depend on any external utilities, even if
it's less secure.

> I'm not sure the current netrc.el approach should be advertised as
> secure, there is more to file encryption than using some block
> cipher in CBC mode, and deriving the key and iv from a password.  It
> is more like obfuscation.  OTOH, obfuscation is what people seem to
> want.  

Let's be realistic, most people want some security but a minimum of
hassle.  I think that netrc.el should actually complain if the netrc
file is plain text in future Gnus versions, *unless* the user says
it's OK.  Whatever scheme we use, it's better than nothing.

> If the reason people want obfuscation is that real security is too
> costly to set up, using GnuPG for .netrc is probably a good idea --
> it is as easy to use as the current nerc.el appear to be, and at
> least it aspires to be secure.

I don't think there's Gnus support for any sort of encryption of netrc
files using GnuPG right now.  How would one set that up?  It was the
lack of such support that made me sit down and modify netrc.el.

Ted