_Final_Project_-_PGP by yaoyufang



Cheng, Ming-Yen
  Hsu, Li Shun
          Table of Content
   Introduction
   History
   How PGP works
   PGP message format
   Up-to-date news
   References
            What is PGP?
 Abbreviation of “Pretty Good Privacy”.
 PGP is a program that uses encryption to
 protect the privacy of your E-mail and files
 in computers.
 It also provide digital signature that allows
 people to prove that files and E-mail
 messages have’t been modified.
        What can PGP do?
Encrypt files.
Create your own public and private keys.
Manage keys. (Create database containing
 public keys of people you correspond with.)
Send and receive encrypted E-mails.
Build digital signature.
Certify keys.(Sign people’s public keys)
   What can PGP do?(Cont.)
Revoke, disable, and escrow keys.
Customize PGP.
Use the PGP Internet key servers.

   Phil Zimmermann   1954
                  Birth of PGP
1.    PRZ wrote pgp1.0. He implemented RSA encryption,
     combined with a symmetric key cipher of his own design
     called Bass-O-Matic.
2.    It later turned out that Bass-O-Matic was weak, and he
     replaced it with the use of IDEA for subsequent versions
     of PGP.
3.    PRZ gave PGP 1.0 to some friends, and they up loaded
     onto a few bulletin boards(US only).
4.    PGP leaked outside the US via the Internet.
5.    RSADSI(RSA Data Security Inc.) complains to PRZ
     that PGP violates their PK patents.
           Birth of PGP(Cont.)
6.    PGP is considered potentially patent infringing because
     of patent right. Eventually PRZ signs an agreement with
     RSADSI. They won't sue him if he stops distributing
     PGP. PRZ has stopped distributing PGP.
7.    Illegality taint increased the spread of PGP, generates
     news, more people get a copy to see what the fuss is
     about (some time passes, PGP gets real popular...).
          USG don't like PRZ
1.     The US government got a complaint from Bidzos
     (president of RSADSI) that PGP broke a bunch of laws.
2.     Customs were under the impression that RSA was
     developed in MIT and PRZ stole it and was not
     distributing it around the world.
3.     USG decided that they don't like PRZ because the NSA
     couldn't tap all those Internet mail messages anymore.
     (the NSA part is speculation, but likely true).
4.     Phil Zimmermann legal defense fund set up to cover his
     legal expenses. This defense fund is now closed since
     the investigation was dropped.
                  MIT Step In
1.    MIT with PRZs approval started distributing a version
     of PGP using RSAREF library(released by RSADSI),
     this ensured that the new version of PGP (2.5) did not
     infringe any patents.
2.    RSADSI threatened MIT with legal action, and
     eventually backs down when MIT refused to budge.
3.    MIT began acting as official US distributor of PGP.
            MIT Step In(Cont.)
4.    The deal with RSA over RSAREF had fixed the patent
     related problems in the US, but it had created a copyright
     related problem outside the US. RSAREF was a
     software package copyrighted by RSADSI, and RSADSI
     did not allow it to be exported.
5.    PGP26i avoided this problem. Main difference between
     pgp2.6 and pgp2.6ui is that pgp26ui uses PRZ’s original
     big integer library, which is faster than RSADSI's
         Current Legal Status
     PGP is legal both inside and outside the US. You just
    need to use pgp262 version inside the US, and pgp262i
    versions outside the US.
     In the US if you are using PGP in a commercial setting,
    and care about patents, you should purchase a copy of
    ViaCrypt pgp2.7
     Commercial use outside the US and Canada: RSA is
    free as PGP is not patented outside the US, but a license
    is required from Ascom Systec for IDEA.
How PGP Works
 PGP combines some of the best
features of both conventional(IDEA) and
public(RSA) key cryptography. So it is a
hybrid cryptosystem.
 A passphrase is a longer version of a
 password, and in theory, a more secure one.
 PGP uses a passphrase to encrypt your
 private key on your machine. Your private
 key is encrypted on your disk using a hash
 function of your passphrase as the secret
 key. You use the passphrase to decrypt and
 use your private key.
       Internet Key Servers
  Internet Key Servers store public keys of
 people who use PGP.
 After creating your own private key and
 public key, PGP will encrypt and store your
 private key and send your public key to it.
 You can get the public key of a person
 with whom you wish to communicate from
1.   Compresses the plaintext
     –   Save transmission time
     –   Save disk space
     –   Strengthen cryptographic security (reduces
         patterns in the plaintext )
     –   Files that are too short to compress or which
         don't compress well aren't compressed.
2.   Creates a session key and encrypt the
     plaintext with it.
     –   a one-time-only secret key
     –   a random number generated from the random
         movements of your mouse and the keystrokes
         you type
3.   Encrypt session key with the recipient's
     public key and put cipher text and
     encrypted session key together.
 Since PGP compress messages before
 encrypting it, size of encrypted message is
 smaller than the original one unless that it is
 too short or too hard to compress.
 For example:
    – A .txt file which is 0.99 MB may become 4.98
     KB after encrypting.
Figure 1. How PGP encryption works
Example – Plain text
Example – Cipher text
Decryption works in the reverse.
   The recipient's copy of PGP uses his or
   her private key to recover the session key.
   Use decrypted session key to decrypt the
   cipher text back to plain text.
Figure 2. How PGP decryption works
           Digital Signature
1.     PGP uses a strong hash function on the
     plaintext and generates a fixed-length data
     item known as a message digest.
2.     Then PGP uses the digest and the private
     key to create the “signature”.
Figure 3. Digital signatures
         Verifying Signature
1.    The recipient’s copy of PGP uses the
     same hash function to get the message
2.    Decrypt the digital signature with public
     key of the sender.
3.    Compare the result of 1. and 2.
           Digital Certificates
    You can use PGP to certify someone’s
    public key that is valid and you trust by
    digitally signing that key. Or verify the
    validity of a public key by checking those
    signatures attached on that key if the key of
    those signer is in your key ring.
Figure 4. Anatomy of a PGP certificate
PGP Message Formats
               Message Format
   Message part :
    - a name for the PGP file;
    - a timestamp;
    - the data;
    Signature part :
     - a timestamp;
     - the key ID of the sender’s public key kA that indentifies
    the public key that should be used to verify the digital
    signature for the file;
     - the leading 2 bytes of the unencrypted message digest
        Message Format(Cont.)
    for the file. This binary sequence enables the recipient to
    determine if the correct public key was used to verify the
    digital signature;
    - the digital signature of the message. It basically consists
    of the message digest encrypted with the inverse of the
    sender’s private key kA;
   Session key part :
    - the encrypted session key {K}kBi;
    - the key ID for the recipient’s public key kBi that was used
    by the sender to encrypt the session key.
Message Format(Cont.)

                     KEY ID OF kB



                                                                       RADIX-64ENCODED MESSAGE
                     KEY ID OF kA

                                        ENCRYPTED with SESSION KEY k
                   LEADING 2 BYTES OF
                    MESSAGE DIGEST

                  DIGITAL SIGNATURE



       Message Format(Cont.)
   A PGP software distribution package can be configured in
    a way that for each message that is encrypted with PGP,
    the corresponding session key is additionally encrypted
    with the Additional Decryption Key(ADK). The aim is to
    provide a simple recovery mechanism for the session keys
    that are used to encrypt messages with PGP.
Up-to-date News
           Latest Version
  The latest U.S. version released by MIT is
 Version 6.5.8. In the new version of PGP,
 MIT replaces RSA algorithm with Diffie
 Hellmann/DSS because they think that RSA
 is the weakest part of PGP.
 The latest international version is Version
 PGP is virtually compatible with all kind
 of platforms now, including Windows
 95/98/NT/2000, MacOS, AIX, HPUX,
 Linux, Solaris, DOS…etc.
 It not only can be used in command line
 mode, but also provides handy graphic user
              Used In VPNs
     PGP 7.0 includes revolutionary peer-to-
    peer VPN capabilities that enable truly
    scalable, enterprise-wide network
    encryption. If enabled, PGP 7.0 will attempt
    to communicate via IPsec whenever an IP-
    based connection is attempted to or from
    another network device.
      Used In VPNs(Cont.)
  Users can now easily connect to VPN
 endpoints that have been configured
 within PGP.
 This release adds support for binding to
 and protecting multiple network adapters
 simultaneously (dial-up, cable modem, DSL,
 LAN, ISDN, etc.), providing VPN
 capabilities on all selected adapters.
        Used In VPNs(Cont.)
     PGP now automatically determines the
    optimal packet size (MTU, Maximum
    Transmission Unit) for each VPN
    connection. This eliminates any packet
    fragmentation that may occur due to
    intermediate Internet routers that use
    smaller packet sizes than the user's ISP.
            PGP Product
 PGP Disk : encrypt entire disk partitions
 PGP Phone : make secure telephone calls
 using a modem or over the Internet
 Plug-ins
   PGP Pretty Good Privacy –Simson Garfinkel

   www.pgpi.org
   web.mit.edu
   www.heureka.clara.net/sunrise/pgp.htm
   netcity1.web.hinet.net/UserData/terry/pgp-faq/
   www.faqs.org/faqs/pgp-faq/
   www.commsec.com/
   cryptography.org
~ The End ~

To top