Problem solve Get help with specific problems with your technologies, process and projects.

Week 33: Pretty Good Privacy --More than pretty good

In this week's column Shelley talks about Pretty Good Privacy.

As needed.

Pretty Good Privacy (PGP) secures e-mails and files against attackers if used on a secure system and configured correctly. (So please don't send me notes or conspiracy theories about how NSA can crack it.) Like a firewall, PGP is a security tool and like any security tool, it isn't secure if you don't understand what you're doing.

The PGP User's Guide explains that PGP is a hybrid cryptosystem: When a user encrypts plaintext with PGP, the data is first compressed, which saves transmission time and disk space and, more importantly, strengthens cryptographic security. Most cryptanalysis techniques exploit patterns found in the plaintext to crack the cipher. Compression reduces these patterns in the plaintext, greatly enhancing resistance to cryptanalysis. PGP then creates a session key, which is a one-time-only secret key generated by random mouse movements and keystrokes. Once the data is encrypted, the session key is encrypted to the recipient's public key and transmitted along with the ciphertext to the recipient. Decryption works in reverse. The recipient's copy of PGP uses his private key to recover the temporary session key, which PGP then uses it to decrypt the conventionally encrypted ciphertext.

Get a current version of PGP that works on your system, unpack and install it. Then make up a secret passphrase and create your public and private keys. Once you validate your public key, you can distribute copies of the public key and upload it to a key server.

Using a good passphrase to protect your private keys and keeping them truly private is key. Rogue software might send your passphrase keystrokes and your PGP key file back to someone who can then use the info to read your messages, another reason to be vigilant about scanning for viruses and spyware.

PGP Corp. publishes its source code so customers and cryptography experts can validate its integrity.

More information
PGP Corp. offers a free limited-capability version of PGP Mail for individual, non-commercial use at, as well as lots of documentation, including the Introduction to Cryptography from the PGP User's Guide. If you're still not sure how it works and want to experiment more, GnuPG is a complete, free replacement for PGP, learn more about it at To read why Philip Zimmermann, the creator of PGP, invented it, go to

About the author,,
Shelley Bard, CISSP, CISM, is a senior security network engineer with Verizon Federal Network Systems (FNS). An information security professional for 17 years, Bard has briefed and written information security assessments and technical reports for the White House and Department of Defense, special interest groups, industry and academia. Please e-mail any comments to

Opinions expressed in this column are those of Shelley Bard and don't necessarily reflect those of Verizon FNS.

Last week: Wireless –Less wires, more issues

Next week: Mid-year review -- what's going right?

This was last published in August 2004

Dig Deeper on Email and Messaging Threats-Information Security Threats

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.