Tip

Week 33: Pretty Good Privacy --More than pretty good

When
As needed.

Why
Pretty Good Privacy (PGP) secures e-mails and files against attackers if used on a secure system and configured correctly. (So please don't send me notes or conspiracy theories about how NSA can crack it.) Like a firewall, PGP is a security tool and like any security tool, it isn't secure if you don't understand what you're doing.

Strategy
The PGP User's Guide explains that PGP is a hybrid cryptosystem: When a user encrypts plaintext with PGP, the data is first compressed, which saves transmission time and disk space and, more importantly, strengthens cryptographic security. Most cryptanalysis techniques exploit patterns found in the plaintext to crack the cipher. Compression reduces these patterns in the plaintext, greatly enhancing resistance to cryptanalysis. PGP then creates a session key, which is a one-time-only secret key generated by random mouse movements and keystrokes. Once the data is encrypted, the session key is encrypted to the recipient's public key and transmitted along with the ciphertext to the recipient. Decryption works in reverse. The recipient's copy of PGP uses his private key to recover the temporary session key, which PGP then uses it to decrypt the conventionally encrypted ciphertext.

Get a current version of PGP that works on your system, unpack and install it. Then make up a secret passphrase and create your public and private keys. Once you validate your public key, you can distribute

    Requires Free Membership to View

copies of the public key and upload it to a key server.

Using a good passphrase to protect your private keys and keeping them truly private is key. Rogue software might send your passphrase keystrokes and your PGP key file back to someone who can then use the info to read your messages, another reason to be vigilant about scanning for viruses and spyware.

PGP Corp. publishes its source code so customers and cryptography experts can validate its integrity.

More information
PGP Corp. offers a free limited-capability version of PGP Mail for individual, non-commercial use at http://www.pgp.com, as well as lots of documentation, including the Introduction to Cryptography from the PGP User's Guide. If you're still not sure how it works and want to experiment more, GnuPG is a complete, free replacement for PGP, learn more about it at http://www.gnupg.org. To read why Philip Zimmermann, the creator of PGP, invented it, go to http://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html.

About the author,,
Shelley Bard, CISSP, CISM, is a senior security network engineer with Verizon Federal Network Systems (FNS). An information security professional for 17 years, Bard has briefed and written information security assessments and technical reports for the White House and Department of Defense, special interest groups, industry and academia. Please e-mail any comments to mailto:securityplanner@infosecuritymag.com.

Opinions expressed in this column are those of Shelley Bard and don't necessarily reflect those of Verizon FNS.

Last week: Wireless –Less wires, more issues

Next week: Mid-year review -- what's going right?

This was first published in August 2004

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.