Secure voice software issues

[karn@qualcomm.com (Phil Karn)]

>To me at least this seems unimportant for the application.  If all you're
>doing is exchanging session keys over the phone, it doesn't really matter if
>you are sure that the public key actually belongs to who it claims it does,

Well...yes. *If* you know the person you are talking to, then you can
read off your session key (or preferably its hash) to guard against the
man in the middle. But let's say you are being referred to someone who
you don't already know (or you know them only by email, and have no idea
what they sound like). You trust this person, but you can't depend on
an oral challenge-response. The existing PGP web should be handy here.

Phil