See also: Cryptography | Encrypting Your Mail | GPG
Acronym: Pretty Good Privacy
Home Page: http://www.pgp.com or http://web.mit.edu/network/pgp.html
A popular system for secure communication and authentication that can:
- Securely encrypt files, e-mail, and simple text.
- Allow secure communication with individuals and groups you have never physically met.
- Provide digital signatures for documents to confirm identity or validity, such as a newly uploaded file that has been checked for any viruses or for a public post by important individuals.
- Automatically compress every file it encrypts.
- Save binary files as text, useful for Newsgroup postings
Considered by many to be a standard in encryption and authentication, PGP is useful for individuals far away or in a large workgroup where users can be included or unincluded as needed as a mutual password is not needed. Commercial PGP is free for personal and educational use while the open-source GPG is free software.
Although the name “Pretty Good” implies it is only adequate, PGP is quite secure.
Originally created by Phil Zimmerman.
- Download commercial version:
- PGP Freeware (U.S./Canada only)
- Commercial PGP (PGP Corporation)
- 1 Open-Source version
- 2 Web mail services that use PGP
- 3 Reasons for use
- 4 How it works
- 5 PGP is not perfect
- 6 Public PGP key servers
- 7 Example of a PGP/GPG Encrypted Message:
- 8 = Links
GPG is a near-clone version of PGP but free, fully open-source, and GPL‘d. Although GPG is not as user-friendly as the corporately-owned PGP and lacks the patented IDEA algorithm, it is otherwise fully compatible and just as useful.
- … Other front-ends for all platforms.
Web mail services that use PGP
- HushMail (Free, Disclosed Source Front End, HushMail Corporation)
- Lokmail – (Non-free, Standards-compliant PGP service except older RSA keys, LOKMAIL, Inc.)
- PGP-like, but not RFC2440
- Non-Commercial (Free, Open Source Back+Front End, CryptoMail Organization)
Reasons for use
How it works
Two or more people who wish to securely communicate exchange portions of their keys, called public keys. Using software or an available Web service, the information is processed so parties can communicate without fear of eavesdropping.
See the PGP Intro.
PGP can also be used to create a Digital Signature that allows a user to claim a specific file as their own and to verify its authenticity.
PGP is not perfect
PGP is mainly vulnerable only to two attacks: A man-in-the-middle attack and by chosing a poor password. To protect against “man-in-the-middle,” users can check that the public key they are getting is the authentic by downloading it from a PGP Public Server or Certificate Authority. In the absense of either, checking the Fingerprint can also verify a key’s validity, which should be distributed elsewhere such as on a public forum (that cannot be edited like infoAnarchy).
Public PGP key servers
To store your public key for anyone to access
Example of a PGP/GPG Encrypted Message:
BEGIN PGP MESSAGE—–
Version: GnuPG v1.2.1 (MingW32) – WinPT 0.7.96rc1
END PGP MESSAGE—–
- OpenPGP charter
- RFC2440 (OpenPGP Message Format)
- RFC3156 (MIME Security with OpenPGP)
- Digital signature
- Public key / private key
- Hard Disk Encryption – one popular free tool is distributed in by PGP International as well as PGP Inc.’s own commercial offering.
- PGP Universal – shifting PGP software from being local to the network.
- Giftfile System – decentralized gift economy in which authors and publishers give non-proprietary works, and supporters give money.
TakeDown.NET -> “Pretty-Good-Privacy”