PGP - Pretty Good Privacy Information Summary by Scott Gartner

Table of Contents

PGP and Encryption terms
If you want to... Activity related instructions
Keys and key servers available via WWW
Key rings available via FTP
Key servers available via e-mail
PGP related links
News groups related to PGP

PGP, or Pretty Good Privacy for short, is a program which gives everyone access to "strong" encryption. Why would you need access to "strong" encryption? Security. Let's examine a few scenario's where PGP would come in handy:
1. You are negotiating a contract with a company and you want to send the next revision of the contract to them. It has to be in electronic form so that they can modify it if they need to. If you simply attach the contract to your message you cannot be assured that it will a) get to the destination without having been read by someone in the middle, and b) they cannot be assured that you are the one who sent the contract.
2. You are active in a news group (alt.conspiracies or alt.barney.die.die.die for example) and somebody decides that they don't like your point of view and so they start to post opposite views posing as you. How would you combat this? Well, you would get your public key signed by other people you trust that share the news group, then send your public key to a key server. You would then post the name of the key server on the news group so that anyone who wanted to could download your key. From then on, any message you post to the news group, you would sign. The forger, though they could still create messages with your name, could not sign the mail and everyone could then tell when you had truly posted by using their copy of your public key and PGP to validate your signature.
3. You want to send your credit card number to a company in an e-mail message, so you use the companies public key to encrypt the message before you send it.
4. You are truly paranoid and you don't want the government finding out about your grassy knoll fetish.

Terms

ASCII armor	A format used by pgp to create files that can be pasted safely into Internet mail. This format is related to uuencoding, but the two are not compatible. If you cannot attach files to e-mail messages, you will want to use this to allow you to paste or insert encrypted or signed files.
Checksum	A number that is generated for a specific file. This number can be used to ensure that the file has not changed since the last checksum was calculated (if they are the same it has not changed). This method is not as secure as CRC.
CRC	Cyclical Redundancy Check. A number that is generated for a specific file. This number can be used to ensure that the file has not changed since the last CRC was calculated (if they are the same it has not changed). This method is more secure than checksum and it's security is a function of the size of the CRC).
Encrypt	To change a message to make it harder for an outside party to read the message while still allowing the recipient to read the message.
Key Fingerprint	A CRC calculated from the key. PGP will generate a key fingerprint to compare with a known fingerprint. This allows you to verify a key (assuming the fingerprint is trusted).
pass phrase	A phrase used to control access to a private key. PGP will ask for a pass phrase when it creates a key and will require this phrase every time you use the key. This phrase should be long enough to be hard to guess while still being memorable. For maximum security it should contain at least one punctuation character (comma, period, dollar sign, etc.) and capital character, but try not to make the punctuation "correct" to make it hard to guess (for example "this I$s a test").
PGP	Pretty Good Privacy. A public key cryptographic system written by Philip Zimmermann using RSA Data Security's public key encryption libraries.
private key	The private half of a key. The private key should only be available to the owner of the key and should never be given to any other person. The private key is protected by a pass phrase to prevent unauthorized use. The private key is used by PGP to sign and decrypt messages.
public key	The public half of a key. The public key should be given to any person who you wish to be able to verify your signature or to send you encrypted data. The public key contains your user ID (usually your e-mail address) and any signatures. The private key is used by PGP to sign and encrypt messages (messages encrypted using your private key can only be decrypted using your private key, not your public key; pgp -c).
Public Key Cryptography	A method of using public and private keys so that you don't need a secure method of passing keys between parties wishing to share encrypted information.
Radix64	The method used by PGP to create ASCII data that can be pasted into any e-mail program (called ASCII Armor).
RSA	RSA is a public-key cryptosystem for both encryption and authentication; it was invented in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman. It works as follows: take two large primes, p and q, and find their product n = pq; n is called the modulus. Choose a number, e, less than n and relatively prime to (p-1)(q-1), and find its inverse, d, mod (p-1)(q-1), which means that ed = 1 mod (p-1)(q-1); e and d are called the public and private exponents, respectively. The public key is the pair (n,e); the private key is d. The factors p and q must be kept secret, or destroyed.
Sign a key	Use your private key to assert your trust of another persons public key. If you get a public key from a public location (like the Internet) you cannot verify that the key was actually created by the person you think it was. However, if the key is signed by a person whose public key you have (and you trust not only that person's public key but that person as well) then you can trust the new key. If you sign that trusted key and then you pass that key on to someone who has your public key (and who trusts you) then they can, by relation, trust the new key. Using this method you can build what is called a "Web of Trust." You should not sign a key without a high level of trust in that key. Signing keys arbitrarily will not only damage your ability to trust keys in your public key ring, but may damage the opinion that other people have of you if you sign a key that turns out not to be trustworthy. PGP will warn you when you use an unsigned key.
Sign a message	PGP signs messages using your private key. That message can then be verified as coming from you by anyone who obtains a trusted copy of your public key. If you intend to sign messages to a certain person, you must either give that person your public key or they must get your public key from a key server.
Strong Encryption	Encryption that uses a sufficiently long key so as to make decryption by professionals not worth the cost of decryption. PGP encryption can be broken, but the time frame for breaking a PGP encrypted message is measured in years (thousands to millions). By the time the message was decrypted any data in the message would surely be useless, or if the person decrypting the message had access to thousands of computers at once, while the message might be cracked in only a few tens of years, it is unlikely that the value of the message would be greater than the cost of decrypting the message.
Trusted key	A trusted key is a key that either you trust because (for example) the person whose key it is handed it to you on a disk over coffee (which you immediately signed using PGP); or the key was obtained from a public source and you were able to compare the key's fingerprint with a trusted fingerprint which you got from your friend over a (different) coffee table; or the key has been signed with a trusted key from your public key ring (the signing key was presumably obtained with one of the first two methods). Your public key will contain many trusted keys that are signed by other trusted keys in your key ring (many of the possibly signed by yourself, by definition the most trusted key in your ring).
User ID	A user ID is the identifying name on a public or private key. By convention the user ID's used when creating keys are the user's name and e-mail address (for example my PGP user ID is "Scott Gartner <sgartner@pingbot.com>"). You can specify only part of a user ID when PGP requests it (as long as the part does not identify more than one user in your public key ring). For example, you could call PGP with: pgp -kv scottg if your public ring did not contain any other entries with scottg in them, or you could call PGP with: pgp -kv "Scott Gartner <sgartner@pingbot.com>" to be absolutely certain.
Uuencode	A common method used on the Internet for changing a file into text that can be used in the body of an e-mail message. PGP uses a similar method called ASCII Armor. They are not compatible with each other though they look similar. If your mail reader does not allow you to attach encrypted files, you must use either ASCII Armor or uuencoding to send binary files across the Internet.
Validate a signature	If you get a message or file that somebody has signed using PGP, then you must first obtain that persons public key, then you should ask PGP to validate the signature. PGP will use the person's public key, the message, and the signature to determine if the person whose public key you have was actually the person who created the original signature (and presumably the message that was signed).
Weak Encryption	Any encryption method where the encryption key can be discovered by professionals in less time than it takes for the data to become worthless or where the cost of decryption is less than the value of the data. Because the definition of weak encryption hinges on the data, you must be aware of either the life or the value of the data being encrypted in determining if you are safely encrypting the information. For a more informed solution you should read one of the many books on strong encryption (such as PGP: Pretty Good Encryption published by O'Reilly & Associates, Inc.).
Wiping files	If you have just created a very sensitive document (it has the truth about where you were on Tuesday when you stood your date up for dinner) you may decide to encrypt the file. Using the command PGP -c date.doc you would create the file date.pgp. Unfortunately just erasing the file date.doc from your hard drive is not good enough (cause your date knows how to unerase files) so you need to do something better. Telling PGP to wipe the file: pgp -cw date.doc , PGP will write a pattern on top of your original file before deleting it so that even if your date successfully unerases date.doc it will no longer be any good (this also means that if you forget the phrase you used to encrypt date.doc you won't be able to get date.doc back either).

If you want to ...

... generate a new public (and private) key:

pgp -kg

... sign a file using your private key:

pgp -s filename

... encrypt a file that only one person can decrypt:

pgp -e filename userID

... encrypt a file that you and only one other person can decrypt:

pgp -e filename userID yourUserID

... encrypt a file that more than one person can decrypt (including you):

pgp -e filename userID_1 userID_2 userID_3 yourUserID

... sign and encrypt a file that only one person can decrypt:

pgp -es filename userID

... distribute your public key:

pgp -kxa userID filename pubring

key will be written to filename.asc

... publish your key using an Internet key server:

pgp -kxa userID filename pubring

key will be written to filename.asc

... Send a message to one of the key servers (i.e. pgp-public-keys@pgp.ai.mit.edu))

The subject must be: add

The message should be the contents of filename.asc

Most of the key servers share keys, so sending it to multiple servers is usually not necessary.

... get someone's public key from an Internet key server:

Send a message to one of the key servers (i.e. pgp-public-keys@pgp.ai.mit.edu)) The subject must be: get userID

The body of the message should be empty.

A message will come back containing the public key you requested or an error message.

... get the public keys for anyone who has a micron Internet account:

Send a message to one of the key servers (i.e. pgp-public-keys@pgp.ai.mit.edu) The subject must be: mget @micron.net

The body of the message should be empty.

A message will come back containing the public key you requested or an error message.

... learn more about sending messages to an Internet key server:

Send a message to one of the key servers (i.e. pgp-public-keys@pgp.ai.mit.edu). The subject must be: help

The body of the message should be empty.

A message will come back containing a list of all valid commands on the server.

... verify a signature or decrypt a file that has been encrypted with your public key:

pgp filename

... protect yourself when your private key has been lost, stolen, or you have forgotten your pass phrase:

Generate a certificate to revoke your own key:

pgp -kd yourUserID

pgp -kxa userID filename pubring

The revoke certificate (which looks the same as a public key) will be written to filename.asc

Widely disseminate this key revocation certificate as soon as possible. If you originally sent this key to any key servers, you should send the revoke certificate to the same servers. Other people who receive it can add it to their public key rings, and their PGP software then automatically prevents them from accidentally using your old public key ever again. You can then generate a new secret/public key pair and publish the new public key.

... use the MIT key server through the World Wide Web:

browse to: http://bs.mit.edu:8001/pks-toplev.html

Choose either Extract a key or Submit a key

Follow the instructions on the page that came up.

Most of the key servers share keys, so sending it to multiple servers is usually not necessary.

Keys and key servers available via WWW

Key rings available via FTP

Key servers available via e-mail

PGP related links

a good collection of PGP related links

a great tutorial for getting started with PGP.

a good reference on PGP and security on the Internet

a web based key server and other PGP information

Florian Helmberger's Homepage

PGP User's Guide, Volume I: Essential Topics

PGP User's Guide, Volume II: Special Topics

PHOAKS: Resources for alt.security.pgp

The WPGP home page.

Using Microsoft Windows with PGP

Non-Technical PGP FAQ

How encryption works.

Legal aspects of encryption.

News groups related to PGP

The only news group I know of for PGP is: alt.security.pgp

Last updated Monday, February 21, 2005

Pretty Good Privacy(tm) is copyrighted © 1990-1994 Philip Zimmermann, Phil's Pretty Good Software.