PGP (Pretty Good Privacy)

PGP (Pretty Good Privacy) is a cryptosystem (encryption system) that was invented by Philip Zimmermann, a computer analyst. From 1984 to 1991, Philip Zimmermann worked on a program that made it possible to run RSA on personal computers (PGP).

It is extremely fast and reliable, which makes it almost impossible to cryptanalyze.

Basics of PGP

E-mail is a common fixture in most U.S. households, despite having inherent privacy and authenticity issues. Broadly speaking, PGP is an e-mail encryption program that can address some e-mail security concerns. More accurately, PGP is a public-key cryptographic suite, providing encryption, digital signatures, key generation, and key management functionality. Although PGP may be used to encrypt and sign arbitrary data and is often used for disk encryption, it is primarily used for e-mail encryption. For convenience, this chapter specifically discusses e-mail and may use the phrase “unencrypted e-mail” in cases where “unencrypted data” or “disk” might apply.

Anyone who can tap the network may intercept and read unencrypted traffic. Although tapping wires or corrupting network routers are not simple tasks, unencrypted wireless access points that are vulnerable to eavesdropping are becoming common. Snoops may intercept traffic sent through insecure access points and archive it for later analysis. This lack of privacy is inherent in most e-mail and instant messaging applications.

E-mail also lacks secure mechanisms to ensure message authenticity and integrity. As most spam recipients know, it is a trivial matter to send a message with an arbitrary “From:” header. Without cryptographic protection, it is easy to forge both message origins and contents. The lack of e-mail authentication is becoming more of a problem as viruses and worms cull e-mail addresses from infected hosts’ address books or as “phishing” attacks forge official-looking e-mail in an attempt to steal login details. How can you ensure that your message wasn’t intercepted or modified in transit? How can you tell if a coworker really sent you a message with an attachment?

How can you tell if a message really originated from an online stock broker or an auction site?

PGP address all of these problems using public-key cryptography. PGP guarantees e-mail privacy by encrypting messages with the recipient’s public key. This encrypted e-mail can only be read by the holder of the corresponding private key, namely the intended receiver. PGP provides e-mail authenticity and integrity through digital signatures. Users can sign message contents and headers prior to encryption. This allows users to verify that signatures on message contents and headers correspond to the received plaintext message.

This abstract view of encryption and signatures ignores the problem of key distribution. How does the sender acquire the receiver’s public key to encrypt? How does the receiver acquire the sender’s public key to verify signatures? Essentially, how does any user know that any public key is authentic?

Most cryptographic systems rely on a public key infrastructure (PKI) to store and distribute public keys. All users in the system will implicitly trust some part of the PKI, usually a certain certificate authority (CA). All trust in the system is implicitly derived from trust in the CA. In practice, most PKIs are hierarchical and have one centralized authority that all users implicitly trust. One innovation of PGP is that it may either use a centralized PKI or a “web of trust” model, which is discussed in the following section.

The principle of PGP

PGP is a hybrid cryptography system that uses a combination of functions taken from public-key cryptography and symmetric cryptography.

When a user encrypts a text with PGP, the data are first compressed. This data compression makes it possible to reduce transmission time via any communication channel, save disk space and, most importantly, increase cryptographic security.

Most cryptanalysts exploit models found in plaintext to break the encryption. Compression reduces these models in plaintext, therefore considerably improving resistance to cryptanalysis.

Encryption then primarily takes place in two phases:

• PGP randomly creates a secret IDEA key and encrypts the data with this key
• PGP encrypts the secret IDEA key and sends it using the recipient's RSA public key.

Decryption also takes place in two phases:

• PGP decrypts the secret IDEA key using the RSA private key.
• PGP decrypts the data with the previously obtained secret IDEA key.

This encryption method combines the easy use of public-key encryption with the speed of conventional encryption. Conventional encryption is approximately 1,000 times faster than public-key encryption algorithms. Public-key encryption resolves the problem of key distribution. Used together, these two methods improve the performance and management of keys without compromising security.