Pretty Good Privacy

VIBHUTI BHUSHAN B080487CS, S-VII, CSE

1

Introduction

Pretty Good Privacy (PGP)

"If all the personal computers in the world - 260 million were put to work on a single PGP-encrypted message, it would still take an estimated 12 million times the age of the universe, on average, to break a single message.
- Deputy Director William Crowell National Security Agency 3/20/2007

Vibhuti Bhushan, B.Tech., CSE, NITC

Pretty Good Privacy

PGP is an encryption technique that provides confidentiality, authentication, and compression for email and data storage. Its building blocks are made of the best available cryptographic algorithms: RSA, DSS, Diffie-Hellman. It is independent of operating system and processor. It has a small set of easy-to-use commands

Vibhuti Bhushan, B.Tech., CSE, NITC

3

Introduction

Pretty Good Privacy (PGP)

PGP is one of the most popular encryption and authentication algorithm world-wide

The first version of PGP was programmed in 1991 by Phil R. Zimmerman, who later founded PGP Security Consulting. till now many versions of PGP has been launched.
Phil R. Zimmerman

Most recent being PGP Universal Gateway Vibhuti Bhushan, B.Tech., CSE, Email, Desktop email..etc...
NITC

Introduction (continues)

Pretty Good Privacy (PGP)

PGP is a hybrid cryptosystem; it is a combination of some of the best known encryption algorithms in existence. While PGP has the speediness of a symmetric-key encryption algorithm, it maintains the high level of security of a public-key encryption algorithm.

Vibhuti Bhushan, B.Tech., CSE, NITC

PGP Components
Scenarios Key Rings PGP Certificates Key Revocation Extracting Information from Rings PGP Packets PGP Messages
Vibhuti Bhushan, B.Tech., CSE, NITC 6

Every sender and reciever keeps a set of his own public-key , private-key pair and of all the users also, to whom he wants to send message. And to each user sender assigns a Trust level : full, partial, none. PGP certificates used to check key legitimacy of others.

Vibhuti Bhushan, B.Tech., CSE, NITC 7

A compressed message being sent

Vibhuti Bhushan, B.Tech., CSE, NITC

Confidentiality with one-time session key

Vibhuti Bhushan, B.Tech., CSE, NITC

Public Key Ring Table Formation

Vibhuti Bhushan, B.Tech., CSE, NITC

10

Continued...

Vibhuti Bhushan, B.Tech., CSE, NITC

11

No Hierarchy for Certificate

Vibhuti Bhushan, B.Tech., CSE, NITC

12

Trust Model in PGP

Vibhuti Bhushan, B.Tech., CSE, NITC

13

Introduction
The following algorithms are employed by PGP: 1. IDEA Cipher
- developed by James Massey & Xuejia Lai in 1990

2. RSA Public Key Encryption

- developed by Rivest, Shamir, and Adelman in 1977

3. GZIP
- A combination of Lempel-Ziv and Huffman Encoding

Vibhuti Bhushan, B.Tech., CSE, NITC

14

Algorithm (continues)

PGP Improvements:
1. Instead of using the the same key each time, PGP randomly generated a new IDEA key for every session. The same message sent at different times will be totally different and remembering the key will be useless and unnecessary. 2. The IDEA key is encrypted via RSA public key encryption algorithm. Decryption can be achieved only by those who knows the complementary key. 3. PGP compresses packages with GZIP.
Vibhuti Bhushan, B.Tech., CSE, NITC 15

Algorithm (continues)

How PGP Encrypts:

1. Original text is encrypted into IDEA cipher text with a 128-bit random key via IDEA encryption. 2. The IDEA session key is encrypted with a large public key via RSA encryption. 3. The encrypted IDEA session key is appended to the IDEA cipher text.

4. GZIP is used to compress the data into a PGP package.

Vibhuti Bhushan, B.Tech., CSE, NITC

16

Algorithm (continues)

How PGP Encrypts:

Vibhuti Bhushan, B.Tech., CSE, NITC

17

Algorithm (continues)

How PGP Decrypts:

1. PGP package is decompressed and is separated into the encrypted IDEA session key and the encrypted IDEA cipher text. 2. IDEA session key is decrypted with RSA private key. 3. IDEA session key decrypts the IDEA cipher text into the original plain text.

Vibhuti Bhushan, B.Tech., CSE, NITC

18

Algorithm (continues)

How PGP Decrypts:

Vibhuti Bhushan, B.Tech., CSE, NITC

19

Why PGP is Better!!!

PGP over IDEA & RSA:

Although IDEA and RSA are very strong encrypting algorithms, they do have their weaknesses: IDEA uses a single and lengthy key while RSA employs complex and lengthy computations.

By combining both IDEA and RSA, PGP uses the strengths of one algorithm to compensate for the weaknesses of the other. As the result, PGP is one of the strongest and fastest encrypting algorithm in existence.

Vibhuti Bhushan, B.Tech., CSE, NITC

20

Recent Activities concerning PGP

On April 29, 2010 Symantec Corp announced that it would acquire PGP for $300 million. In December 1997, PGP Inc. was acquired by Network Associates Inc. ("NAI which is now named McAfee) In August 2002, several ex-PGP team members formed a new company, PGP Corporation. Vibhuti Bhushan, B.Tech., CSE,

NITC

21

Current PGP Products

PGP Desktop 10.1 (Windows and Mac-OS Platforms) OpenPGP ---The Free Software Foundation has developed its own OpenPGP-compliant program called GNU Privacy Guard(abbreviated GnuPG or GPG)

Vibhuti Bhushan, B.Tech., CSE, NITC

22

Current PGP Products

PGP Desktop 9.x family includes PGP Desktop Email, PGP Whole Disk Encryption, and PGP NetShare.

Depending on application, the products feature desktop email, digital signatures, IM security, whole disk encryption, file and folder security, self decrypting archives, and secure shredding of deleted files.

Vibhuti Bhushan, B.Tech., CSE, NITC

23

Current PGP Products

PGP Command Line, which enables command line-based encryption and signing of information for storage, transfer, and backup, PGP Support Package for BlackBerry which enables RIM BlackBerry devices to enjoy sender-to-recipient messaging encryption.

Vibhuti Bhushan, B.Tech., CSE, NITC 24

References
PGP International Homepage. http://www.pgpi.org, 2001. PGP Security BIND vulnerability COVERT CyberCop Gauntlet. www.pgp.com, 2001. Back, Adam, PGP Timeline. http://www.cypherspace.org/~adam/timeline/, 1998. Brown, Lawrie, Cryptography and Computer Security. http://www.cs.adfa.oz.au/teaching/studinfo/csc/lectures/, 2001. Davie and Peterson, Larry L., Computer Networks. 2nd ed. Boston: Morgan Kaufmann, 2000. Page 599-601. Gimon, Charles A., The Phil Zimmerman Case. http://www.skypoint.com/members/gimonca/philzima.html, 1996.

Vibhuti Bhushan, B.Tech., CSE, NITC

25

Thank You!!!!!