[Cryptography] Email is unsecurable

[Arnold Reinhold]

On Mon, 25 Nov 2013 19:27  Benjamin Kreuter wrote:
> Fortunately, there is a solution that we have long been aware of, which
> is smart cards.  You can plug a smart card into a computer, let it do
> the decryption of your messages, and thus enjoy typical usage
> patterns.  One can imagine some simple security features to help deal
> with compromised computers.
> 
> Of course, standing in the way of this is the fact that such a system
> would require a bunch of new hardware to be deployed, and the only
> organizations that have the resources to do so (at scale) have an
> interest in preventing such a system from being deployed.  

With the maker movement, open hardware, Adruino, et al, the barrier to entry for hardware has dropped dramatically. Crowd source funding is available. Someone mentioned DigiSpark on this list and I bought the full development package for $15 at my local computer store. The boards themselves cost $9 each and have a built in USB connector.  The Attiny85 SoC chip it uses costs $1.29 quantity one. It has 6kb of available flash memory, plenty for RC4 with improved key scheduling and a small key book. One could possibly shoe horn in AES (see eg http://electronics.stackexchange.com/questions/13275/smallest-aes-implementation-for-microcontrollers).  Other tiny, inexpensive single board systems (eg RFduino) are available with low power Bluetooth 4.0 that could sit in one's pocket and talk to a smartphone, encrypting e-mail or, what people really care about, IM. Other inexpensive SoC chips are available with more memory that could potentially do public key. 

Simple hardware systems have less space to hide backdoors.  I don't want to dump on the people trying to improve existing e-mail protocols and infrastructure, but maybe we should explore different, simpler paths at the same time. 

Arnold Reinhold