Experimental Physics and
Industrial Control System

[email protected] (Alan K Biocca) · Fri, 10 Feb 95 16:00:22 PST

Bob:

I suggest we use pgp encryption for releases.  Pass phrases can be handled
over the landline or some other reasonably secure medium.  We can select
one pass-phrase per release or one per year to make it easier.  Only the
1-2 people per site who actually get and install releases need to know
this access key.

Pgp is available from MIT free of charge for all US based sites.

If a release is tarred up and then encrypted it is one easy pass
to decrypt before detarring.

This technology also allows digital signing of releases so they cannot
be altered without detection.  This provides another layer of protection
against errors in transmission.

Since the pass phrase never traverses the net it should be adequately
secure.  Even someone on the inside would have a difficult time getting
to it unless they can pervert your local copy of the pgp binary, and you
can check for that.  Besides, if they can get on your machine they can
read your decrypted source tree anyway.

--Alan

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System