PGP (thing)

This writeup was originally written in 1997

In 1991 a computing consultant from Colorado released into the public domain a program that would revolutionise internet communications world-wide, allow anyone with a computer the right to secure communication and almost land the author of this program in prison for munitions export. The program was PGP or “Pretty Good Privacy” by Phil Zimmermann and it had such strong encryption that it was considered a practical impossibility to crack it, even with the vast resources of the US Government. It used the RSA public key encryption algorithm removing the need to send a private key “in clear”, traditionally the weak link in all encryption (the German Enigma cipher couldn’t have been cracked nearly so quickly if several machines hadn’t been captured by the Allied forces). The release of the soft ware onto the Internet and the subsequent indictment of Phil Zimmermann caused one of the biggest debates on freedom of the Internet in its history.

PGP uses three different algorithms in its operation; these are the RSA public key encryption system, the IDEA symmetric key cipher and MD5, a 128bit checksum used to validate message integrity.

• RSA Public Key Encryption
  This encryption method uses a public key algorithm, essentially allowing you to encrypt a message with one key which is publicly known which can then only be decrypted by a private key held only by the recipient, alternatively a message can be encoded with a private key and decoded using a public key to allow secure signing of messages. It is a fairly safe algorithm when used with key lengths of 512 bits or more but cannot compare with conventional methods for safety of encryption for a given length of key and is also much slower. It is used by PGP only to transfer the key to the main cipher (IDEA).
• IDEA Symmetric Key Cipher
  This encryption method is used by PGP to encode the main message. It is very secure and is considered unbreakable for the foreseeable without the key. Using 1 billion processors each operating at 1 billion keys per second (much faster than the fastest CPUs are capable) it would take over 1000 times the age of the universe to crack. It is used by PGP to encode the message. It is a symmetric cipher so the message can be both encoded and decoded using the same key.
• MD5
  This is not an encryption system but it is a complicated algorithm for generating a 128-bit checksum (unique to that message) which can be used to verify that a message hasn’t been tampered with.

1. Signing: An encrypted (or unencrypted) message can be signed to provide absolute proof that the message did indeed come from its apparent recipient. To achieve this, MD5 is applied to the message to get a unique checksum that can only apply to that message. This is then encrypted using RSA and the sender’s private key (which only he knows), this can then be decoded using the sender’s public key (as held by the recipient) to verify that the message is authentic. This works on the principal that only the sender’s public key will decrypt a message encrypted with his private key, which only the sender knows, therefore if it can be decoded it must be from him. The signature is sent along with the main body of the message.
2. Encryption: Firstly a unique and random 128bit key is generated for that session (called the session key), the message (or the message and its encoded signature) is then encoded using IDEA using this key. The random key is then encoded using the RSA method with the recipient’s public key and these two encoded parts are combined to form the encoded message (along with a signature if one is present).
3. Decryption: To decode the message, the recipient applies his private key to the encoded session key to obtain the session key. This is then applied to the main IDEA encoded message to decode the message, and, if applicable, the electronic signature.
4. Authentication: To verify that a message is authentic, the recipient must decode the checksum using the sender’s public key and then MD5 applied to the message to compare with the checksum sent with the message (if they match the message has not been tampered with).

For years the US Government had been promoting an encryption system based on the "Clipper" chip. This was because encoded into every chip was a secret back door allowing the government to listen in to encrypted phone conversations, read encrypted email and access sensitive documents. The advent of PGP meant that not only did every computer user in the United States have access to a powerful an virtually unbreakable encryption program but it could also be copied abroad over the internet. The uploading of the package to an internet newsgroup caused the US Government to attempt to prosecute Phil Zimmermann under the Arms Export Control Act. They failed in there attempt to do this however, dropping the case in January 1996.

The reasons for this are, in my view, completely unjustified, in the information age many people have access to email and it is fast becoming a standard feature for business cards to carry an email address alongside phone and fax numbers. This means that there is a huge volume of plain text transmitted, most of it private and some of it undoubtedly classified industrial secrets. This is simple to intercept and change, far easier than a phone tap or mail intercept and if it is changed there is no sure way of detecting it. Some email software comes with the DES encryption method that uses a 46 bit key, but it has been shown that with a machine costing only one million dollars, a sum well within the budget of most multinational companies, can break these codes in a matter of hours and no verification of authenticity is available. The PGP system makes unbreakable cryptography free, as it should be, and available to the general public.

The viewpoint of the US Government is understandable in that the software could be used by oppressive regimes in the third world but the algorithms used are internationally known and the software could just as easily be written in the UK, Russia or even Libya. The irony of this is that in such a case, the software would be freely available in America as no such restriction applies to importing encryption software.

Though the case against Phil Zimmermann has been dropped, controversy and debate still rages over whether a government has the right to invade a citizen’s privacy by tapping phone lines, intercepting mail and reading email. PGP prevents this, email is unbreakably encrypted and there will soon be a package called PGPhone released which allows you to use a modem as a secure telephone line, it is even possible to use PGP to encrypt regular letters, though this is very uncommon. The government approved clipper chip will form a part of a system in the United States where at any one time 1% of all telephone calls made will be able to be tapped at once, with a simple point and click system, but the clipper chip will not be able to help the charities to save refugees of oppressive regimes, as PGP has done, because the governments will be able to intercept every email and phone call. As Phil himself puts it "If you outlaw privacy, only outlaws will have privacy". Email encryption will form an important part of the internet in the next millennium, possibly becoming used for all emails as envelopes are now used to protect normal mail from prying eyes. PGP will most likely become the package of choice from its world-wide distribution and fame, and of course its unbreakable algorithms.

Update

With the recent upsurge in terrorist activity caused by the World Trade Center bombings, calls for further restriction have been made, with PGP again becoming the poster child for the Big Brother generation.