pcanywhere encryption

[hermit1 <hermits () mac com>]

I wouldn't bother people with this, except Symantec tech support claims to 
know nothing about how their encryption works.  (Actually, they claim their 
product does not do encryption, it merely passes the data to Microsoft 
programs for encryption when appropriate.  Doesn't that make you feel safe?)

My organization is looking into ways of expanding remote access 
capabilities.  One program we are trying is pcAnywhere from Symantec.  The 
documentation claims there are 4 levels of encryption available:
1.  None  -  Symantec recommends against using this
2.  pcAnywhere  -  Symantec also recommends against using this
3.  Symmetric key  -  recommended
4.  Public key  -   recommended as stronger than #3.  But as near as I can 
tell, this has the same level of encryption as #3 except you need a 
certificate setup to use it.

For symmetric keys, the manual states "pcAnywhere generates a unique public 
key and uses this key to encrypt and safely pass the symmetric key used to 
encrypt the session."

Since there is no provision for selecting how the encrypted key gets 
decrypted by which client or server (there is no statement about which end 
of the connection generates the keys), the only conclusion I can draw is 
that the "unique public key" can be decrypted by ANY pcAnywhere host or 
client anywhere.  Well, I can draw another conclusion that both the public 
and private keys are sent at the same time, but that procedure seems even 
more stupid than my first conclusion.

Can anyone help out by explaining what Symantec is actually doing to set up 
encrypted sessions?  Symantec can't explain it.

Thanks,
hermit1
_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards