To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
None. This is a fine way to do it. I know of an Internet-based financial
transaction system that uses precisely this mechanism. When you make a
stock trade (for example), the client software makes a PGP message and
FTPs it to a directory, where the processing servers decrypt it.
Using PGP has the additional advantage that it uses ZIP (actually called
Deflate) compression on your file, which is apt to make it smaller. If you
are already compressing the file, you can remove this step from your
process.
There are some gotchas you should be aware of:
If you make PGP generate binary (.pgp) output, make sure you FTP it in
binary mode. A common mistake is to transfer it in text mode, which may
corrupt the file.
If you want to be perfectly safe, you can have PGP generate ascii-armored
output (.asc) and send this. However, the ascii-armoring adds 33% to the
size of the file. This is often more than made up for by compression. If
you are doing this regularly, it's best to iron out the kinks so that you
send properly in binary mode.
It's still a good idea to put your PGP files into some inobvious place.
If you FTP them to a public directory where an anonymous user could delete
them, then you run that risk. When I've done this myself, I create a
directory to copy them into that isn't available to anonymous users.
Using PGP as opposed to SSL is different in that you are encrypting the
data object, rather than the pipe. Once your file gets to its destination,
it's still protected. This is arguably safer, but also arguably less
convenient. Some people might argue that it's better to use PGP, but it is
certainly not *less* secure than SSL.
I'll also add as one final note that a related, but slightly different
strategy would be to PGP-encrypt the files and e-mail them. But you might
want to shoot that down because of the size of them. E-mailing 25-40MB files
can cause other problems. Because of their size, I think FTP is a fine way
to go and better than mailing them.
For more information on this topic, visit these other SearchSecurity.com resources:
Best Web Links: Cryptography, PGP, PKI
|
