text:
Pretty Good Privacy
From Wikipedia, the free encyclopedia
Jump to: navigation, search
Pretty Good Privacy
Original author(s)
Phil Zimmermann
PGP Inc.
Network Associates
PGP Corp.[1]
Developer(s)
Symantec
Initial release
1991 (1991)
Development status
Active
Type
Encryption software
License
Commercial proprietary software
Website
www.pgp.com
Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications. Phil Zimmermann developed PGP in 1991.[2]
PGP and similar software follow the OpenPGP standard (RFC 4880) for encrypting and decrypting data.
Contents
[hide]
1 Design
1.1 Compatibility
1.2 Confidentiality
1.3 Digital signatures
1.4 Web of trust
1.5 Certificates
1.6 Security quality
2 History
2.1 Early history
2.2 Criminal investigation
2.3 PGP 3 and founding of PGP Inc.
2.4 Network Associates acquisition
2.5 Current situation
3 PGP Corporation encryption applications
4 OpenPGP
5 Limitations
6 See also
7 References
8 Further reading
9 External links
Design[edit]
How PGP encryption works
PGP encryption uses a serial combination of hashing, data compression, symmetric-key cryptography, and finally public-key cryptography; each step uses one of several supported algorithms. Each public key is bound to a user name or an e-mail address. The first version of this system was generally known as a web of trust to contrast with the X.509 system, which uses a hierarchical approach based on certificate authority and which was added to PGP implementations later. Current versions of PGP encryption include both options through an automated key management server.
Compatibility[edit]
As PGP evolves, versions that support newer features and algorithms are able to create encrypted messages that older PGP systems cannot decrypt, even with a valid private key. Therefore, it is essential that partners in PGP communication understand each other's capabilities or at least agree on PGP settings.
Confidentiality[edit]
PGP can be used to send messages confidentially. For this, PGP combines symmetric-key encryption and public-key encryption. The message is encrypted using a symmetric encryption algorithm, which requires a symmetric key. Each symmetric key is used only once and is also called a session key. The message and its session key are sent to the receiver. The session key must be sent to the receiver so they know how to decrypt the message, but to protect it during transmission it is encrypted with the receiver's public key. Only the private key belonging to the receiver can decrypt the session key.
Digital signatures[edit]
PGP supports message authentication and integrity checking. The latter is used to detect whether a message has been altered since it was completed (the message integrity property) and the former to determine whether it was actually sent by the person or entity claimed to be the sender (a digital signature). Because the content is encrypted, any changes in the message will result in failure of the decryption with the appropriate key. The sender uses PGP to create a digital signature for the message with either the RSA or DSA algorithms. To do so, PGP computes a hash (also called a message digest) from the plaintext and then creates the digital signature from that hash using the sender's private key.
Web of trust[edit]
Main article: Web of trust
Both when encrypting messages and when verifying signatures, it is critical that the public key used to send messages to someone or some entity actually does 'belong' to the intended recipient. Simply downloading a public key from somewhere is not an overwhelming assurance of that association; deliberate (or accidental) impersonation is possible. From its first version, PGP has always included provisions for distributing user's public keys in an 'identity certificate', which is also constructed cryptographically so that any tampering (or accidental garble) is readily detectable. However, merely making a certificate which is impossible to modify without being detected is insufficient; this can prevent corruption only after the certificate has been created, not before. Users must also ensure by some means that the public key in a certificate actually does belong to the person or entity claiming it. From its first release, PGP products have included an internal certificate 'vetting scheme' to assist with this, a trust model which has been called a web of trust. A given public key (or more specifically, information binding a user name to a key) may be digitally signed by a third party user to attest to the association between someone (actually a user name) and the key. There are several levels of confidence which can be included in such signatures. Although many programs read and write this information, few (if any) include this level of certification when calculating whether to trust a key.
The web of trust protocol was first described by Phil Zimmermann in 1992, in the manual for PGP version 2.0:
As time goes on, you will accumulate keys from other people that you may want to designate as trusted introducers. Everyone else will each choose their own trusted introducers. And everyone will gradually accumulate and distribute with their key a collection of certifying signatures from other people, with the expectation that anyone receiving it will trust at least one or two of the signatures. This will cause the emergence of a decentralized fault-tolerant web of confidence for all public keys.
The web of trust mechanism has advantages over a centrally managed public key infrastructure scheme such as that used by S/MIME but has not been universally used. Users have been willing to accept certificates and check their validity manually or to simply accept them. No satisfactory solution has been found for the underlying problem.
Certificates[edit]
In the (more recent) OpenPGP specification, trust signatures can be used to support creation of certificate authorities. A trust signature indicates both that the key belongs to its claimed owner and that the owner of the key is trustworthy to sign other keys at one level below their own. A level 0 signature is comparable to a web of trust signature since only the validity of the key is certified. A level 1 signature is similar to the trust one has in a certificate authority because a key signed to level 1 is able to issue an unlimited number of level 0 signatures. A level 2 signature is highly analogous to the trust assumption users must rely on whenever they use the default certificate authority list (like those included in web browsers); it allows the owner of the key to make other keys certificate authorities.
PGP versions have always included a way to cancel ('revoke') identity certificates. A lost or compromised private key will require this if communication security is to be retained by that user. This is, more or less, equivalent to the certificate revocation lists of centralised PKI schemes. Recent PGP versions have also supported certificate expiration dates.
The problem of correctly identifying a public key as belonging to a particular user is not unique to PGP. All public key/private key cryptosystems have the same problem, even if in slightly different guises, and no fully satisfactory solution is known. PGP's original scheme at least leaves the decision as to whether or not to use its endorsement/vetting system to the user, while most other PKI schemes do not, requiring instead that every certificate attested to by a central certificate authority be accepted as correct.
Security quality[edit]
To the best of publicly available information, there is no known method which will allow a person or group to break PGP encryption by cryptographic or computational means. Indeed, in 1995, cryptographer Bruce Schneier characterized an early version as being "the closest you're likely to get to military-grade encryption."[3] Early versions of PGP have been found to have theoretical vulnerabilities and so current versions are recommended.[4] In addition to protecting data in transit over a network, PGP encryption can also be used to protect data in long-term data storage such as disk files. These long-term storage options are also known as data at rest, i.e. data stored, not in transit.
The cryptographic security of PGP encryption depends on the assumption that the algorithms used are unbreakable by direct cryptanalysis with current equipment and techniques.
In the original version, the RSA algorithm was used to encrypt session keys. RSA's security depends upon the one-way function nature of mathematical integer factoring.[5] Similarly, the symmetric key algorithm used in PGP version 2 was IDEA, which might at some point in the future be found to have previously undetected cryptanalytic flaws. Specific instances of current PGP or IDEA insecurities (if they exist) are not publicly known. As current versions of PGP have added additional encryption algorithms, their cryptographic vulnerability varies with the algorithm used. However, none of the algorithms in current use are publicly known to have cryptanalytic weaknesses.
New versions of PGP are released periodically and vulnerabilities are fixed by developers as they come to light. Any agency wanting to read PGP messages would probably use easier means than standard cryptanalysis, e.g. rubber-hose cryptanalysis or black-bag cryptanalysis (e.g. installing some form of trojan horse or keystroke logging software/hardware on the target computer to capture encrypted keyrings and their passwords). The FBI has already used this attack against PGP[6][7] in its investigations. However, any such vulnerabilities apply not just to PGP but to any conventional encryption software.
In 2003, an incident involving seized Psion PDAs belonging to members of the Red Brigade indicated that neither the Italian police nor the FBI were able to decrypt PGP-encrypted files stored on them.[8]
A second incident in December 2006, (see In re Boucher), involving US customs agents who seized a laptop PC that allegedly contained child pornography, indicates that US government agencies find it "nearly impossible" to access PGP-encrypted files. Additionally, a magistrate judge ruling on the case in November 2007 has stated that forcing the suspect to reveal his PGP passphrase would violate his Fifth Amendment rights i.e. a suspect's constitutional right not to incriminate himself.[9][10] The Fifth Amendment issue was opened again as the government appealed the case and a federal district judge ordered the defendant to provide the key.[11]
Evidence suggests that as of 2007, British police investigators are unable to break PGP,[12] so instead have resorted to using RIPA legislation to demand the passwords/keys. In November 2009 a British citizen was convicted under RIPA legislation and jailed for nine months for refusing to provide police investigators with encryption keys to PGP-encrypted files.[13]
History[edit]
Early history[edit]
Phil Zimmermann created the first version of PGP encryption in 1991. The name, "Pretty Good Privacy" was inspired by the name of a grocery store, "Ralph's Pretty Good Grocery", featured in radio host Garrison Keillor's fictional town, Lake Wobegon.[14] This first version included a symmetric-key algorithm that Zimmermann had designed himself, named BassOmatic after a Saturday Night Live sketch. Zimmermann had been a long-time anti-nuclear activist, and created PGP encryption so that similarly inclined people might securely use BBSs and securely store messages and files. No license was required for its non-commercial use. There was not even a nominal charge, and the complete source code was included with all copies.
In a posting of June 5, 2001, entitled "PGP Marks 10th Anniversary",[15] Zimmermann describes the circumstances surrounding his release of PGP:
It was on this day in 1991 that I sent the first release of PGP to a couple of my friends for uploading to the Internet. First, I sent it to Allan Hoeltje, who posted it to Peacenet, an ISP that specialized in grassroots political organizations, mainly in the peace movement. Peacenet was accessible to political activists all over the world. Then, I uploaded it to Kelly Goen, who proceeded to upload it to a Usenet newsgroup that specialized in distributing source code. At my request, he marked the Usenet posting as "US only". Kelly also uploaded it to many BBS systems around the country. I don't recall if the postings to the Internet began on June 5th or 6th.
It may be surprising to some that back in 1991, I did not yet know enough about Usenet newsgroups to realize that a "US only" tag was merely an advisory tag that had little real effect on how Usenet propagated newsgroup postings. I thought it actually controlled how Usenet routed the posting. But back then, I had no clue how to post anything on a newsgroup, and didn't even have a clear idea what a newsgroup was.
PGP found its way onto the Internet and rapidly acquired a considerable following around the world. Users and supporters included dissidents in totalitarian countries (some affecting letters to Zimmermann have been published, some of which have been included in testimony before the US Congress), civil libertarians in other parts of the world (see Zimmermann's published testimony in various hearings), and the 'free communications' activists who called themselves cypherpunks (who provided both publicity and distribution); decades later, CryptoParty activists did much the same via Twitter.
Criminal investigation[edit]
Shortly after its release, PGP encryption found its way outside the United States, and in February 1993 Zimmermann became the formal target of a criminal investigation by the US Government for "munitions export without a license". Cryptosystems using keys larger than 40 bits were then considered munitions within the definition of the US export regulations; PGP has never used keys smaller than 128 bits, so it qualified at that time. Penalties for violation, if found guilty, were substantial. After several years, the investigation of Zimmermann was closed without filing criminal charges against him or anyone else.
Zimmermann challenged these regulations in an imaginative way. He published the entire source code of PGP in a hardback book,[16] via MIT Press, which was distributed and sold widely. Anybody wishing to build their own copy of PGP could cut off the covers, separate the pages, and scan them using an OCR program (or conceivably enter it as a type-in program if OCR software was not available), creating a set of source code text files. One could then build the application using the freely available GNU Compiler Collection. PGP would thus be available anywhere in the world. The claimed principle was simple: export of munitions—guns, bombs, planes, and software—was (and remains) restricted; but the export of books is protected by the First Amendment. The question was never tested in court with respect to PGP. In cases addressing other encryption software, however, two federal appeals courts have established the rule that cryptographic software source code is speech protected by the First Amendment (the Ninth Circuit Court of Appeals in the Bernstein case and the Sixth Circuit Court of Appeals in the Junger case).
US export regulations regarding cryptography remain in force, but were liberalized substantially throughout the late 1990s. Since 2000, compliance with the regulations is also much easier. PGP encryption no longer meets the definition of a non-exportable weapon, and can be exported internationally except to seven specific countries and a list of named groups and individuals[17] (with whom substantially all US trade is prohibited under various US export controls).
PGP 3 and founding of PGP Inc.[edit]
During this turmoil, Zimmermann's team worked on a new version of PGP encryption called PGP 3. This new version was to have considerable security improvements, including a new certificate structure which fixed small security flaws in the PGP 2.x certificates as well as permitting a certificate to include separate keys for signing and encryption. Furthermore, the experience with patent and export problems led them to eschew patents entirely. PGP 3 introduced use of the CAST-128 (a.k.a. CAST5) symmetric key algorithm, and the DSA and ElGamal asymmetric key algorithms, all of which were unencumbered by patents.
After the Federal criminal investigation ended in 1996, Zimmermann and his team started a company to produce new versions of PGP encryption. They merged with Viacrypt (to whom Zimmermann had sold commercial rights and who had licensed RSA directly from RSADSI), which then changed its name to PGP Incorporated. The newly combined Viacrypt/PGP team started work on new versions of PGP encryption based on the PGP 3 system. Unlike PGP 2, which was an exclusively command line program, PGP 3 was designed from the start as a software library allowing users to work from a command line or inside a GUI environment. The original agreement between Viacrypt and the Zimmermann team had been that Viacrypt would have even-numbered versions and Zimmermann odd-numbered versions. Viacrypt, thus, created a new version (based on PGP 2) that they called PGP 4. To remove confusion about how it could be that PGP 3 was the successor to PGP 4, PGP 3 was renamed and released as PGP 5 in May 1997.
Network Associates acquisition[edit]
In December 1997, PGP Inc. was acquired by Network Associates, Inc. ("NAI"). Zimmermann and the PGP team became NAI employees. NAI was the first company to have a legal export strategy by publishing source code. Under NAI, the PGP team added disk encryption, desktop firewalls, intrusion detection, and IPsec VPNs to the PGP family. After the export regulation liberalizations of 2000 which no longer required publishing of source, NAI stopped releasing source code.[18]
In early 2001, Zimmermann left NAI. He served as Chief Cryptographer for Hush Communications, who provide an OpenPGP-based e-mail service, Hushmail. He has also worked with Veridis and other companies. In October 2001, NAI announced that its PGP assets were for sale and that it was suspending further development of PGP encryption. The only remaining asset kept was the PGP E-Business Server (the original PGP Commandline version). In February 2002, NAI canceled all support for PGP products, with the exception of the renamed commandline product. NAI (formerly McAfee, now Intel Security) continued to sell and support the product under the name McAfee E-Business Server until 2013.[19][20]
Current situation[edit]
In August 2002, several ex-PGP team members formed a new company, PGP Corporation, and bought the PGP assets (except for the command line version) from NAI. The new company was funded by Rob Theis of Doll Capital Management (DCM) and Terry Garnett of Venrock Associates. PGP Corporation supports existing PGP users and honors NAI's support contracts. Zimmermann now serves as a special advisor and consultant to PGP Corporation, as well as continuing to run his own consulting company. In 2003, PGP Corporation created a new server-based product called PGP Universal. In mid-2004, PGP Corporation shipped its own command line version called PGP Command Line, which integrates with the other PGP Encryption Platform applications. In 2005, PGP Corporation made its first acquisition—the German software company Glück & Kanja Technology AG,[21] which is now PGP Deutschland AG.[22] In 2010, PGP Corporation acquired Hamburg-based certificate authority TC TrustCenter and its parent company, ChosenSecurity, to form its PGP TrustCenter[23] division.[24]
Since the 2002 purchase of NAI's PGP assets, PGP Corporation has offered worldwide PGP technical support from its offices in Draper, Utah; Offenbach, Germany; and Tokyo, Japan.
On April 29, 2010, Symantec Corp. announced that it would acquire PGP for $300 million with the intent of integrating it into its Enterprise Security Group.[25] This acquisition was finalized and announced to the public on June 7, 2010. The source code of PGP Desktop 10 is available for peer review.[26]
Also in 2010, Intel Corporation acquired McAfee. In 2013, the McAfee E-Business Server was transferred to Software Diversified Services, which now sells, supports, and develops it under the name SDS E-Business Server.[19][20]
This section contains content that is written like an advertisement. Please help improve it by removing promotional content and inappropriate external links, and by adding encyclopedic content written from a neutral point of view. (November 2017) (Learn how and when to remove this template message)
For the enterprise, Townsend Security currently offers the only commercial versions of PGP for the IBM i and IBM z mainframe platforms. Townsend Security became involved with PGP encryption in 2000 when the company partnered with Network Associates and ported PGP encryption to the IBM i platform. Later in 2008 Townsend Security ported PGP to the IBM z mainframe.
IBM z supports PGP with z/OS encryption facility, which is available for free and uses hardware acceleration.
PGP Corporation encryption applications[edit]
This section describes commercial programs available from PGP Corporation. For information on other programs compatible with the OpenPGP specification, see External links below.
While originally used primarily for encrypting the contents of e-mail messages and attachments from a desktop client, PGP products have been diversified since 2002 into a set of encryption applications which can be managed by an optional central policy server. PGP encryption applications include e-mail and attachments, digital signatures, laptop full disk encryption, file and folder security, protection for IM sessions, batch file transfer encryption, and protection for files and folders stored on network servers and, more recently, encrypted or signed HTTP request/responses by means of a client-side (Enigform) and a server-side (mod openpgp) module. There is also a Wordpress plugin available, called wp-enigform-authentication, that takes advantage of the session management features of Enigform with mod_openpgp.
The PGP Desktop 9.x family includes PGP Desktop Email, PGP Whole Disk Encryption, and PGP NetShare. Additionally, a number of Desktop bundles are also available. Depending on application, the products feature desktop e-mail, digital signatures, IM security, whole disk encryption, file and folder security, encrypted self-extracting archives, and secure shredding of deleted files. Capabilities are licensed in different ways depending on features required.
The PGP Universal Server 2.x management console handles centralized deployment, security policy, policy enforcement, key management, and reporting. It is used for automated e-mail encryption in the gateway and manages PGP Desktop 9.x clients. In addition to its local keyserver, PGP Universal Server works with the PGP public keyserver—called the PGP Global Directory—to find recipient keys. It has the capability of delivering e-mail securely when no recipient key is found via a secure HTTPS browser session.
With PGP Desktop 9.x managed by PGP Universal Server 2.x, first released in 2005, all PGP encryption applications are based on a new proxy-based architecture. These newer versions of PGP software eliminate the use of e-mail plug-ins and insulate the user from changes to other desktop applications. All desktop and server operations are now based on security policies and operate in an automated fashion. The PGP Universal server automates the creation, management, and expiration of keys, sharing these keys among all PGP encryption applications.
The Symantec PGP platform has now undergone a rename. PGP Desktop is now known as Symantec Encryption Desktop, and the PGP Universal Server is now known as Symantec Encryption Management Server. The current shipping versions are Symantec Encryption Desktop 10.3.0 (Windows and Mac OS platforms) and Symantec Encryption Server 3.3.2.
Also available are PGP Command Line, which enables command line-based encryption and signing of information for storage, transfer, and backup, as well as the PGP Support Package for BlackBerry which enables RIM BlackBerry devices to enjoy sender-to-recipient messaging encryption.
New versions of PGP applications use both OpenPGP and the S/MIME, allowing communications with any user of a NIST specified standard.[citation needed]
OpenPGP[edit]
Inside PGP Inc., there was still concern about patent issues. RSADSI was challenging the continuation of the Viacrypt RSA license to the newly merged firm. The company adopted an informal internal standard they called "Unencumbered PGP" which would "use no algorithm with licensing difficulties". Because of PGP encryption's importance worldwide, many wanted to write their own software that would interoperate with PGP 5. Zimmermann became convinced that an open standard for PGP encryption was critical for them and for the cryptographic community as a whole. In July 1997, PGP Inc. proposed to the IETF that there be a standard called OpenPGP. They gave the IETF permission to use the name OpenPGP to describe this new standard as well as any program that supported the standard. The IETF accepted the proposal and started the OpenPGP Working Group.
OpenPGP is on the Internet Standards Track and is under active development. Many e-mail clients provide OpenPGP-compliant email security as described in RFC 3156. The current specification is RFC 4880 (November 2007), the successor to RFC 2440. RFC 4880 specifies a suite of required algorithms consisting of ElGamal encryption, DSA, Triple DES and SHA-1. In addition to these algorithms, the standard recommends RSA as described in PKCS #1 v1.5 for encryption and signing, as well as AES-128, CAST-128 and IDEA. Beyond these, many other algorithms are supported. The standard was extended to support Camellia cipher by RFC 5581 in 2009, and signing and key exchange based on Elliptic Curve Cryptography (ECC) (i.e. ECDSA and ECDH) by RFC 6637 in 2012. Support for ECC encryption was added by the proposed RFC 4880bis in 2014.
The Free Software Foundation has developed its own OpenPGP-compliant program called GNU Privacy Guard (abbreviated GnuPG or GPG). GnuPG is freely available together with all source code under the GNU General Public License (GPL) and is maintained separately from several Graphical User Interfaces (GUIs) that interact with the GnuPG library for encryption, decryption and signing functions (see KGPG, Seahorse, MacGPG). Several other vendors have also developed OpenPGP-compliant software.
The development of an opensource OpenPGP-compliant library, OpenPGPjs,[27] written in JavaScript has allowed web based applications to use PGP encryption in the web browser.
There are several iOS and Android OpenPGP-compliant applications such as iPGMail[28] for iOS and OpenKeychain[29] for Android, which enable key generation and encryption/decryption of email and files on Apple's iOS and Google's Android.
PGP
RFC 1991 PGP Message Exchange Formats (obsolete)[30]
OpenPGP
RFC 2440 OpenPGP Message Format (obsolete)[30]
RFC 4880 OpenPGP Message Format
RFC 5581 The Camellia Cipher in OpenPGP
RFC 6637 Elliptic Curve Cryptography (ECC) in OpenPGP
RFC 4880bis (draft) OpenPGP Message Format
PGP/MIME
RFC 2015 MIME Security with Pretty Good Privacy (PGP)
RFC 3156 MIME Security with OpenPGP
OpenPGP's encryption can ensure secure delivery of files and messages, as well as provide verification of who created or sent the message using a process called digital signing. The open source office suite LibreOffice implemented document signing with OpenPGP as of version 5.4.0 on Linux.[31] Using OpenPGP for communication requires participation by both the sender and recipient. OpenPGP can also be used to secure sensitive files when they're stored in vulnerable places like mobile devices or in the cloud.[32]
Limitations[edit]
With the advancement of cryptography, parts of PGP have been criticized for being dated:
The long length of PGP public keys[33]
Difficulty for the users to comprehend and poor usability[34]
Lack of ubiquity[34]
In October 2017, the ROCA vulnerability was announced that affects RSA keys generated on the Yubikey 4 tokens, often used with PGP. Many published PGP keys were found to be susceptible.[35]
See also[edit]
Cryptography portal
Bernstein v. United States
Electronic envelope
Email encryption
Email privacy
GNU Privacy Guard
Key server (cryptographic)
PGP word list
PGPDisk
Pretty Easy privacy
Public-key cryptography
S/MIME
X.509
ZRTP
References[edit]
Jump up ^ "Where to Get PGP". philzimmermann.com.
Jump up ^ Zimmermann, Philip R. (1999). "Why I Wrote PGP". Essays on PGP. Philip Zimmermann.
Jump up ^ Schneier, Bruce (October 9, 1995). Applied Cryptography. New York: Wiley. p. 587. ISBN 0-471-11709-9.
Jump up ^ Messmer, Ellen (August 28, 2000). "Security flaw found in Network Associates' PGP". Network World. Retrieved May 2, 2017 – via Google Books.
Jump up ^ Nichols, Randall (1999). ICSA Guide to Cryptography. McGrawHill. p. 267. ISBN 0-07-913759-8.
Jump up ^ "United States v. Scarfo (Key-Logger Case)". Epic.org. Retrieved 2010-02-08.
Jump up ^ McCullagh, Declan (July 10, 2007). "Feds use keylogger to thwart PGP, Hushmail | Tech news blog - CNET News.com". News.com. Retrieved 2010-02-08.
Jump up ^ "PGP Encryption Proves Powerful". PCWorld. May 26, 2003. Retrieved 2010-02-08.
Jump up ^ McCullagh, Declan (December 14, 2007). "Judge: Man can't be forced to divulge encryption passphrase | The Iconoclast - politics, law, and technology - CNET News.com". News.com. Retrieved 2010-02-08.
Jump up ^ McCullagh, Declan (January 18, 2008). "Feds appeal loss in PGP compelled-passphrase case | The Iconoclast - politics, law, and technology - CNET News.com". News.com. Retrieved 2010-02-08.
Jump up ^ McCullagh, Declan (February 26, 2009). "Judge orders defendant to decrypt PGP-protected laptop". CNET news. Retrieved 2009-04-22.
Jump up ^ John Leyden (November 14, 2007). "Animal rights activist hit with RIPA key decrypt demand". The Register.
Jump up ^ Chris Williams (November 24, 2009). "UK jails schizophrenic for refusal to decrypt files". The Register. p. 2.
Jump up ^ Holtsnider, Bill; Jaffe, Brian D. (2006). IT manager's handbook: getting your new job done (2nd ed.). Morgan Kaufmann. p. 373.
Jump up ^ "PGP Marks 10th Anniversary". Phil Zimmermann. Retrieved 2010-08-23.
Jump up ^ Zimmermann, Philip (1995). PGP Source Code and Internals. MIT Press. ISBN 0-262-24039-4.
Jump up ^ "Lists to Check". US Department of Commerce, Bureau of Industry and Security. Retrieved December 4, 2011.
Jump up ^ "Important Information About PGP & Encryption". proliberty.com. Retrieved 2015-03-24.
^ Jump up to: a b "McAfee partners with Software Diversified Services to deliver E-Business Server sales and support." 2014-01-17. Retrieved 2015-06-30. https://kc.mcafee.com/corporate/index?page=content&id=KB79203
^ Jump up to: a b "Long Live E-Business Server for Enterprise-Scale Encryption." Software Diversified Services. 2013-08-11. Retrieved 2015-06-30. http://www.sdsusa.com/newsdocs/130811.sds.ebs.pdf
Jump up ^ "glueckkanja.com". glueckkanja.com. Retrieved 2013-08-06.
Jump up ^ "pgp.de". pgp.de. Retrieved 2013-08-06.
Jump up ^ "pgptrustcenter.com". pgptrustcenter.com. January 26, 2010. Retrieved 2013-08-06.
Jump up ^ "News Room - Symantec Corp". Pgp.com. Retrieved 2012-03-23.
Jump up ^ "Symantec buys encryption specialist PGP for $300M". Computerworld. April 29, 2010. Retrieved 2010-04-29.
Jump up ^ "Symantec PGP Desktop Peer Review Source Code". Symantec.com. September 23, 2012. Retrieved 2013-08-06.
Jump up ^ OpenPGPjs-Team. "OpenPGPjs".
Jump up ^ "iPGMail". iPGMail.
Jump up ^ OpenKeychain-Team. "OpenKeychain". openkeychain.org.
^ Jump up to: a b http://tools.ietf.org/html/rfc4880
Jump up ^ "OpenPGP signature support in LibreOffice". Thorsten's Weblog. 28 July 2017. Retrieved 10 December 2017.
Jump up ^ By Eric Geier, PCWorld. “How to use OpenPGP to encrypt your email messages and files in the cloud.” August 22, 2014. September 3, 2014.
Jump up ^ Green, Matthew (August 13, 2014). "What's the matter with PGP?". A Few Thoughts on Cryptographic Engineering. Retrieved December 19, 2016.
^ Jump up to: a b Marlinspike, Moxie (February 24, 2015). "GPG And Me". Retrieved December 19, 2016.
Jump up ^ The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli, Matus Nemec, Marek Sys, Petr Svenda, Dusan Klinec,Vashek Matyas, November 2017
Further reading[edit]
Garfinkel, Simson (December 1, 1991). PGP: Pretty Good Privacy. O'Reilly & Associates. ISBN 1-56592-098-8.
Levy, Steven (January 8, 2001). Crypto: How the Code Rebels Beat the Government—Saving Privacy in the Digital Age. Penguin Books. ISBN 0140244328.
Lucas, Michael W. (April 1, 2006). PGP & GPG Email for the Practical Paranoid. No Starch Press. ISBN 978-1-59327-071-1.
Zimmermann, Phil (June 1991). "Why I Wrote PGP". Retrieved 2008-03-03.
External links[edit]
Official website
OpenPGP::SDK
OnlinePGP.ws Online PGP Encryption
MIT Public Key Directory for Registration and Search
List of public keyservers
IETF OpenPGP working group
OpenPGP Alliance
[hide]
v
t
e
Cryptographic software
Email clients
Apple Mail
Claws Mail
Enigmail
GPG (Gpg4win)
Kontact
Outlook
p≡p
PGP
Sylpheed
Thunderbird
Secure
communication
OTR
Adium
BitlBee
Centericq
ChatSecure
climm
Jitsi
Kopete
MCabber
Profanity
SSH
Dropbear
lsh
OpenSSH
PuTTY
SecureCRT
WinSCP
Xshell
TLS & SSL
Bouncy Castle
BoringSSL
Botan
CryptoComply
cryptlib
GnuTLS
JSSE
LibreSSL
MatrixSSL
NSS
OpenSSL
mbed TLS
RSA BSAFE
SChannel
SSLeay
stunnel
wolfSSL
VPN
Check Point VPN-1
Hamachi
Openswan
OpenVPN
SoftEther VPN
strongSwan
Tinc
ZRTP
CSipSimple
Jitsi
Linphone
Ring
Zfone
P2P
Bitmessage
RetroShare
Tox
DRA
Matrix
OMEMO
Conversations
Cryptocat
ChatSecure
Proteus
Signal Protocol
Google Allo
Facebook Messenger
Signal
TextSecure
WhatsApp
Disk encryption
(Comparison)
BestCrypt
BitLocker
CipherShed
CrossCrypt
Cryptoloop
DiskCryptor
dm-crypt
DriveSentry
E4M
eCryptfs
FileVault
FreeOTFE
GBDE
geli
LUKS
PGPDisk
Private Disk
Scramdisk
Sentry 2020
TrueCrypt
History
VeraCrypt
Anonymity
GNUnet
I2P
Java Anon Proxy
Tor
Vidalia
RetroShare
Ricochet
Wickr
File systems (List)
EncFS
EFS
eCryptfs
LUKS
PEFS
Rubberhose
StegFS
Tahoe-LAFS
Service providers
Freenet
Tresorit
TeamDrive
Wuala
Educational
CrypTool
Related topics
Outline of cryptography
Timeline of cryptography
Hash functions
Cryptographic hash function
List of hash functions
S/MIME
Category
Commons
Portal
Authority control
WorldCat Identities
VIAF: 180726619
LCCN: n94101989
GND: 4370042-1
Retrieved from "https://en.wikipedia.org/w/index.php?title=Pretty_Good_Privacy&oldid=814727367"
Categories:
1991 software
Cryptographic software
History of cryptography
Internet privacy software
OpenPGP
Privacy software
Hidden categories:
Use mdy dates from August 2016
Articles with a promotional tone from November 2017
All articles with a promotional tone
All articles with unsourced statements
Articles with unsourced statements from July 2017
Wikipedia articles with VIAF identifiers
Wikipedia articles with LCCN identifiers
Wikipedia articles with GND identifiers
Pages using RFC magic links
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
Languages
العربية
Azərbaycanca
Беларуская
Беларуская (тарашкевіца)
Català
Čeština
Dansk
Deutsch
Español
Esperanto
Euskara
فارسی
Français
한국어
Hrvatski
Bahasa Indonesia
Italiano
עברית
Lingála
Lumbaart
Magyar
Nederlands
日本語
Norsk
Polski
Português
Русский
Scots
Shqip
Sicilianu
Simple English
Slovenčina
Slovenščina
Српски / srpski
Suomi
Svenska
ไทย
Türkçe
Українська
اردو
Tiếng Việt
中文
Edit links
This page was last edited on 10 December 2017, at 15:28.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view
Enable previews

values: mw-page-base noprint

values: mw-head-base noprint

values: firstHeading firstHeading en

values: siteSub noprint

values: jump-to-nav mw-jump

attrs: scope style

values:
row
white-space: nowrap;

value: span

values:
nofollow
https://www.pgp.com/
external text

values:
/wiki/Data_communication
mw-redirect
Data communication

values:
external mw-magiclink-rfc
nofollow
https://tools.ietf.org/html/rfc4880

values:
/wiki/Symmetric-key_cryptography
mw-redirect
Symmetric-key cryptography

values:
/wiki/RSA_(algorithm)
mw-redirect
RSA (algorithm)

values:
/wiki/Message_digest
mw-redirect
Message digest

values:
/wiki/Identity_certificate
mw-redirect
Identity certificate

values:
/wiki/Psion_(computers)
mw-redirect
Psion (computers)

values:
/wiki/Italian_police
mw-redirect
Italian police

values: Fifth Amendment to the United States Constitution

values:
/wiki/British_police
mw-redirect
British police

values: Regulation of Investigatory Powers Act 2000

values:
/wiki/Civil_libertarians
mw-redirect
Civil libertarians

values: Export of cryptography in the United States

values: First Amendment to the United States Constitution

values: United States Court of Appeals for the Ninth Circuit

values: United States Court of Appeals for the Sixth Circuit

values: Edit section: PGP 3 and founding of PGP Inc.

values:
/wiki/Command_line
mw-redirect
Command line

values:
/wiki/Software_library
mw-redirect
Software library

values: Edit section: Network Associates acquisition

values:
/wiki/Network_Associates
mw-redirect
Network Associates

values:
/wiki/Hush_Communications
mw-redirect
Hush Communications

values:
/wiki/Intel_Security
mw-redirect
Intel Security

values:
/wiki/Intel_Corporation
mw-redirect
Intel Corporation

values: plainlinks metadata ambox ambox-content ambox-Advert

values:
nofollow
external text
http://www.townsendsecurity.com

values: Edit section: PGP Corporation encryption applications

values: This claim needs references to reliable sources. (July 2017)

values:
noprint Inline-Template Template-Fact
white-space:nowrap;

values:
/wiki/IETF_Working_Group
mw-redirect
IETF Working Group

values:
external mw-magiclink-rfc
nofollow
https://tools.ietf.org/html/rfc3156

values:
external mw-magiclink-rfc
nofollow
https://tools.ietf.org/html/rfc2440

values:
external mw-magiclink-rfc
nofollow
https://tools.ietf.org/html/rfc5581

values:
/wiki/Elliptic_curve_cryptography
mw-redirect
Elliptic curve cryptography

values:
/wiki/Elliptic_Curve_DSA
mw-redirect
Elliptic Curve DSA

values:
external mw-magiclink-rfc
nofollow
https://tools.ietf.org/html/rfc6637

values:
/wiki/Elliptic_Curve_Cryptography
mw-redirect
Elliptic Curve Cryptography

values:
external mw-magiclink-rfc
nofollow
https://tools.ietf.org/html/rfc1991

values:
external mw-magiclink-rfc
nofollow
https://tools.ietf.org/html/rfc2015

values: display:table-cell;padding:0.2em 0.2em 0.2em 0.3em;vertical-align:middle

values: margin:0.5em 0 0.5em 1em;border:solid #aaa 1px

values:
/wiki/Electronic_envelope
mw-redirect
Electronic envelope

values: div-col columns column-count column-count-2

values: -moz-column-count: 2; -webkit-column-count: 2; column-count: 2;

values:
nofollow
https://philzimmermann.com/EN/findpgp/
external text

values:
/wiki/Network_World
mw-redirect
Network World

values:
nofollow
external text
http://www.epic.org/crypto/scarfo.html

values:
nofollow
external text
http://glueckkanja.com

values:
nofollow
external text
http://www.pgptrustcenter.com

values:
nofollow
https://openpgpjs.org/
external text

values:
nofollow
external text
https://www.ipgmail.com

values:
nofollow
external text
https://www.openkeychain.org

values:
nofollow
external free
http://tools.ietf.org/html/rfc4880

values:
nofollow
https://moxie.org/blog/gpg-and-me/
external text

values: -moz-column-width: 35em; -webkit-column-width: 35em; column-width: 35em; list-style-type: decimal;

values:
/wiki/O%27Reilly_%26_Associates
mw-redirect
O'Reilly & Associates

values:
nofollow
external text
https://github.com/public/OpenPGP-SDK

values:
nofollow
http://pgp.mit.edu/
external text

values:
nofollow
http://www.openpgp.org/
external text

values: nowraplinks hlist collapsible autocollapse navbox-inner

values:
nofollow
external text
https://viaf.org/viaf/180726619

values:
nofollow
external text
https://d-nb.info/gnd/4370042-1

values: Category:Articles with a promotional tone from November 2017

values: Category:All articles with a promotional tone

values: Category:All articles with unsourced statements

values: Category:Articles with unsourced statements from July 2017

values: Category:Wikipedia articles with VIAF identifiers

values: Category:Wikipedia articles with LCCN identifiers

values: Category:Wikipedia articles with GND identifiers

values: Discussion about edits from this IP address [ctrl-alt-n]

values: A list of edits made from this IP address [ctrl-alt-y]

values: You are encouraged to create an account and log in; however, it is not mandatory

values: You're encouraged to log in; however, it's not mandatory. [ctrl-alt-o]

values:
/wiki/Pretty_Good_Privacy
View the content page [ctrl-alt-c]
c

values: Discussion about the content page [ctrl-alt-t]

values: p-namespaces navigation vectorTabs p-namespaces-label

values:
p-variants
navigation
vectorMenu emptyPortlet
p-variants-label

values: Past revisions of this page [ctrl-alt-h]

values: p-views navigation vectorTabs p-views-label

values:
p-cactions
navigation
vectorMenu emptyPortlet
p-cactions-label

values:
mw-wiki-logo
/wiki/Main_Page
Visit the main page

values:
/wiki/Main_Page
Visit the main page [ctrl-alt-z]
z

values: Featured content – the best of Wikipedia

values: Find background information on current events

values:
/wiki/Special:Random
Load a random article [ctrl-alt-x]
x

values: portal navigation p-navigation p-navigation-label

values: Guidance on how to use and edit Wikipedia

values: About the project, what you can do, where to find things

values: A list of recent changes in the wiki [ctrl-alt-r]

values: portal navigation p-interaction p-interaction-label

values: List of all English Wikipedia pages containing links to this page [ctrl-alt-j]

values: Recent changes in pages linked from this page [ctrl-alt-k]

values:
/wiki/Wikipedia:File_Upload_Wizard
Upload files [ctrl-alt-u]
u

values: A list of all special pages [ctrl-alt-q]

values: Permanent link to this revision of the page

values: Link to connected data repository item [ctrl-alt-g]

values: Printable version of this page [ctrl-alt-p]

values:
uls-settings-trigger
Language settings
0
button
true

values: بي جي بي – Arabic

values:
https://az.wikipedia.org/wiki/PGP
PGP – Azerbaijani
az
az
interlanguage-link-target

values:
https://be.wikipedia.org/wiki/PGP
PGP – Belarusian
be
be
interlanguage-link-target

values: PGP – Belarusian (Taraškievica orthography)

values:
https://eo.wikipedia.org/wiki/PGP
PGP – Esperanto
eo
eo
interlanguage-link-target

values:
https://eu.wikipedia.org/wiki/PGP
PGP – Basque
eu
eu
interlanguage-link-target

values: پی‌جی‌پی (نرم‌افزار) – Persian

values:
https://id.wikipedia.org/wiki/PGP
PGP – Indonesian
id
id
interlanguage-link-target

values:
https://he.wikipedia.org/wiki/PGP
PGP – Hebrew
he
he
interlanguage-link-target

values:
https://ln.wikipedia.org/wiki/PGP
PGP – Lingala
ln
ln
interlanguage-link-target

values:
https://hu.wikipedia.org/wiki/PGP
PGP – Hungarian
hu
hu
interlanguage-link-target

values:
https://pt.wikipedia.org/wiki/PGP
PGP – Portuguese
pt
pt
interlanguage-link-target

values:
https://ru.wikipedia.org/wiki/PGP
PGP – Russian
ru
ru
interlanguage-link-target

values:
https://scn.wikipedia.org/wiki/PGP
PGP – Sicilian
scn
scn
interlanguage-link-target

values:
https://fi.wikipedia.org/wiki/PGP
PGP – Finnish
fi
fi
interlanguage-link-target

values: พีจีพี – Thai

values:
https://uk.wikipedia.org/wiki/PGP
PGP – Ukrainian
uk
uk
interlanguage-link-target

values: پی جی پی – Urdu

values:
https://zh.wikipedia.org/wiki/PGP
PGP – Chinese
zh
zh
interlanguage-link-target

values: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Pretty_Good_Privacy rootpage-Pretty_Good_Privacy skin-vector action-view